- What is CWE-1321?
- The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- What CVEs are caused by CWE-1321?
- 297 recorded CVEs are attributed to CWE-1321, including CVE-2026-34621, CVE-2026-44005, CVE-2026-25881. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- How do you prevent CWE-1321?
- By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
- How is CWE-1321 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-1321?
- Exploiting CWE-1321 can lead to: Read Application Data, Modify Application Data, DoS: Crash, Exit, or Restart.
- Is CWE-1321 actively exploited?
- Yes. 1 CWE-1321 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 297 recorded CVEs.