CVE-2019-10768 in AngularJS
Summary
by MITRE
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/20/2025
The vulnerability identified as CVE-2019-10768 represents a critical prototype pollution flaw within AngularJS versions prior to 1.7.9. This issue stems from the improper handling of object merging operations, specifically the `merge()` function that processes user-supplied data. When malicious actors craft payloads containing `_proto_` properties, they can manipulate the prototype chain of JavaScript objects, leading to unintended behavior across the application. The vulnerability is categorized under CWE-471, which specifically addresses the modification of a structure used in an input validation context, making it particularly dangerous in web applications where user input is processed.
The technical exploitation of this vulnerability occurs when the `merge()` function processes objects containing `_proto_` properties without proper sanitization. This allows attackers to inject malicious properties directly into the Object.prototype, which affects all objects in the JavaScript environment that inherit from it. The flaw is particularly insidious because it can be leveraged to modify core JavaScript object behaviors, potentially enabling arbitrary code execution or bypassing security controls. The vulnerability aligns with ATT&CK technique T1059.007, which covers scripting languages, as it allows for manipulation of the JavaScript runtime environment through prototype pollution attacks.
The operational impact of CVE-2019-10768 extends beyond simple data corruption, as it can lead to complete application compromise. When prototype pollution occurs, it can affect not only the targeted application but also other components that rely on standard JavaScript object behaviors. This vulnerability can be exploited in various attack scenarios including cross-site scripting attacks, where attackers can manipulate the application's behavior to execute malicious scripts. The flaw is particularly dangerous in applications that use AngularJS for data processing and user input handling, as it can allow attackers to modify core object properties and potentially gain unauthorized access to sensitive functionality.
Mitigation strategies for this vulnerability require immediate patching of AngularJS applications to version 1.7.9 or later, which includes proper sanitization of prototype properties during object merging operations. Organizations should implement comprehensive input validation and sanitization measures to prevent malicious payloads from reaching the vulnerable `merge()` function. Additionally, security teams should conduct thorough code reviews focusing on object manipulation functions and implement runtime protections that monitor for prototype pollution attempts. The fix implemented in AngularJS 1.7.9 specifically addresses the issue by ensuring that `_proto_` properties are properly handled during merge operations, preventing unauthorized modifications to object prototypes and maintaining the integrity of the JavaScript runtime environment.