Web SecurityHigh__proto__ pollution

Prototype Pollution

Attacker-controlled keys like __proto__ modify Object.prototype, corrupting application behavior and sometimes enabling RCE or XSS.

Overview

Unsafe recursive merge/clone/set operations let an attacker write to __proto__ or constructor.prototype, injecting properties inherited by all objects - which downstream code then trusts.

How it works

Unsafe recursive merge/clone/set operations let an attacker write to __proto__ or constructor.prototype, injecting properties inherited by all objects - which downstream code then trusts.

Example

json

{"__proto__": {"isAdmin": true}}
// after a vulnerable merge, every object now has isAdmin=true

Impact

Privilege/flag tampering, denial of service, gadget-driven RCE (Node) and XSS (browser).

Detection

Send __proto__/constructor payloads to JSON merge endpoints and observe polluted behavior or reflected gadget effects.

Prevention

Reject __proto__, constructor, prototype keys in input.
Use Map instead of plain objects for key-value data.
Object.freeze(Object.prototype) and Object.create(null) for dictionaries.
Patch vulnerable merge/clone libraries (lodash, etc.).