domains / families / security / hunt-prototype-pollution

hunt-prototype-pollution

separate

Hunt client-side and server-side prototype pollution for XSS, auth bypass, and RCE.

When to use

• Application uses JavaScript/Node.js with object merge, clone, or extend operations on user input.
• jQuery `$.extend(true, ...)` or `$.fn.merge()` with deep copy on untrusted data.
• Lodash `_.merge()`, `_.defaultsDeep()`, `_.set()` receiving request body/query params.
• Template engines (EJS, Pug, Handlebars) in the same runtime as user-controlled objects.
• Server-side Node.js with `child_process.exec`/`spawn` accessible via polluted options.

When not to use

• reporting __proto__ in requests without behavioral impact
• testing Node.js 12+ or newer lodash versions first

Skill page

Source