# Contains All: Descriptions With a Word CVEs whose description contains the word pollution, as in prototype pollution. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/operator-contains-all/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose description contains the word pollution, as in prototype pollution. Example 5 of 8 in **Operators** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `descriptions.value` · `operator` `contains_all` `contains_all` matches text that contains its item. On this endpoint the list must hold a single word: even a two-word phrase such as `prototype pollution` is answered with HTTP 400 ("Value must be a single item in the list for 'contains_all' query"). In the response, look at `results[].descriptions[].value`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `descriptions.value` | | `filters.must[0].type` | body | `contains_all` | | `filters.must[0].value` | body | `["pollution"]` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "descriptions.value", "type": "contains_all", "value": [ "pollution" ] } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 446, "results": [ { "id": "CVE-2026-25881", "source_identifier": "user@github.com", "published": "2026-02-09T22:16:03Z", "last_modified": "2026-06-17T10:25:22Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31." }, { "lang": "es", "value": "SandboxJS es una biblioteca de sandboxing de JavaScript. Antes de la versión 0.8.31, una vulnerabilidad de escape de sandbox permite que el código en sandbox mute los prototipos integrados del host al blanquear la bandera de protección 'isGlobal' a través de intermediarios de literales de array. Cuando una referencia de prototipo global (por ejemplo, Map.prototype, Set.prototype) se coloca en un array y se recupera, la marca 'isGlobal' se elimina, permitiendo la mutación directa del prototipo desde dentro del sandbox. Esto resulta en una contaminación persistente de prototipos del lado del host y puede habilitar RCE en aplicaciones que usan propiedades contaminadas en sumideros sensibles (ejemplo de gadget: execSync(obj.cmd)). Esta vulnerabilidad está corregida en la versión 0.8.31." } ], "references": [ { "url": "https://github.com/nyariv/SandboxJS/commit/f369f8db26649f212a6a9a2e7a1624cb2f705b53", "source": "user@github.com", "tags": [ "Patch" ] }, { "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-ww7g-4gwx-m7wj", "source": "user@github.com", "tags": [ "Exploit", "Mitigation", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-1321" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*", "match_criteria_id": "626B7924-ECB8-4661-A9FA-3A12B095F1DE", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.8.31" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*", "vendor": "nyariv", "product": "sandboxjs", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.8.31", "affected_versions_first": "0.1.0", "affected_versions_last": "0.8.30" } ], "cwe": [ { "id": 1321, "owasptop10_2021": null, "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "description": "The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.", "capec_id": [ 1, 77, 180 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "Modify Application Data", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.0056, "percentile": 0.45461, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-25586", "source_identifier": "user@github.com", "published": "2026-02-06T20:16:10Z", "last_modified": "2026-06-17T10:24:54Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to __proto__ and other blocked prototype properties, enabling host Object.prototype pollution and persistent cross-sandbox impact. This vulnerability is fixed in 0.8.29." }, { "lang": "es", "value": "SandboxJS es una librería de sandboxing de JavaScript. Antes de 0.8.29, es posible un escape del sandbox al sombrear hasOwnProperty en un objeto sandbox, lo que deshabilita la aplicación de la lista blanca de prototipos en la ruta de acceso a propiedades. Esto permite el acceso directo a __proto__ y otras propiedades de prototipo bloqueadas, lo que permite la contaminación del Object.prototype del host y un impacto persistente entre sandboxes. Esta vulnerabilidad está corregida en 0.8.29." } ], "references": [ { "url": "https://github.com/nyariv/SandboxJS/commit/67cb186c41c78c51464f70405504e8ef0a6e43c3", "source": "user@github.com", "tags": [ "Patch" ] }, { "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-jjpw-65fv-8g48", "source": "user@github.com", "tags": [ "Exploit", "Vendor Advisory" ] }, { "url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-jjpw-65fv-8g48", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Exploit", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-74" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*", "match_criteria_id": "5822AD4C-2C8E-4196-9149-A626F0572E05", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.8.29" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:nyariv:sandboxjs:*:*:*:*:*:node.js:*:*", "vendor": "nyariv", "product": "sandboxjs", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.8.29", "affected_versions_first": "0.1.0", "affected_versions_last": "0.8.28" } ], "cwe": [ { "id": 74, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "description": "The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.", "capec_id": [ 3, 6, 7, 8, 9, 10, 13, 14, 24, 28 ], "scope": [ "Access Control", "Confidentiality", "Integrity", "Non-Repudiation", "Other" ], "impact": [ "Alter Execution Logic", "Bypass Protection Mechanism", "Hide Activities", "Other", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00648, "percentile": 0.49662, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-25150", "source_identifier": "user@github.com", "published": "2026-02-03T22:16:30Z", "last_modified": "2026-06-17T10:24:11Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0." }, { "lang": "es", "value": "Qwik es un framework de javascript centrado en el rendimiento. Antes de la versión 1.19.0, existe una vulnerabilidad de contaminación de prototipos en la función formToObj() dentro del middleware @builder.io/qwik-city. La función procesa los nombres de los campos del formulario con notación de puntos (por ejemplo, user.name) para crear objetos anidados, pero no logra sanear nombres de propiedades peligrosos como __proto__, constructor y prototype. Esto permite a atacantes no autenticados contaminar Object.prototype enviando solicitudes HTTP POST manipuladas, lo que podría conducir a escalada de privilegios, omisión de autenticación o denegación de servicio. Este problema ha sido parcheado en la versión 1.19.0." } ], "references": [ { "url": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7", "source": "user@github.com", "tags": [ "Patch" ] }, { "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq", "source": "user@github.com", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "NONE", "integrity_impact": "HIGH", "availability_impact": "LOW", "base_score": 9.3, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 4.7 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-1321" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*", "match_criteria_id": "8A329D09-A8EB-4297-8BD9-4E862179FE54", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.19.0" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*", "vendor": "qwik", "product": "qwik", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.19.0", "affected_versions_first": "0.0.11", "affected_versions_last": "1.18.0" } ], "cwe": [ { "id": 1321, "owasptop10_2021": null, "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "description": "The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.", "capec_id": [ 1, 77, 180 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "Modify Application Data", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00662, "percentile": 0.50259, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CWE Descriptions That Mention a Shortcut](/reference/vulnerability/search/examples/enrichment-cwe-description/) - [Contains Any: Descriptions With One of Several Words](/reference/vulnerability/search/examples/operator-contains-any/) - [Descriptions That Mention JNDI](/reference/vulnerability/search/examples/descriptions-value/)