DB.
Courses

JavaScript Prototype Pollution
OSWE · Chapter 1

JavaScript Prototype Pollution

Prototype pollution is a JavaScript-specific vulnerability where an attacker injects properties into a base object prototype (like Object.prototype), so every object in the application unexpectedly inherits attacker-controlled properties. It can escalate to XSS, authentication bypass, or even remote code execution depending on how the polluted property is later used.

Key concepts

  • Happens most often through unsafe recursive merge/clone/extend utilities that do not block the `__proto__`, `constructor`, or `prototype` keys.
  • A polluted property can silently flip a security-relevant flag (e.g. `isAdmin`) across every object in the app, not just the one the attacker touched.
  • Prevention: use `Object.create(null)` for maps of untrusted keys, or `new Map()`/`new Set()` instead of plain object literals.
  • Node.js can also mitigate with the `--disable-proto=delete` flag as defense in depth, though `constructor.prototype` paths still need blocking separately.

Example

// Vulnerable recursive merge
function merge(target, source) {
  for (const key in source) {
    if (typeof source[key] === "object") merge(target[key] = target[key] || {}, source[key]);
    else target[key] = source[key];
  }
}
// merge({}, JSON.parse('{"__proto__":{"isAdmin":true}}'))

Try it yourself

Write a small Node.js script with the vulnerable merge function above, and confirm that after merging an attacker-supplied `__proto__` payload, a brand new plain object `{}` now has an `isAdmin` property.

ReferenceSearch video walkthroughs

@ Daniel Burlacu