Prototype Pollution

JavaScript injection that rewrites Object.prototype, poisoning every object that inherits from it.

Specifications & Metrics

cwe

CWE-1321

impact

High

Core Principles & Analysis

• Recursive merge functions and query-string parsers are the usual doors: __proto__ as a key.
• Pollution can flip security flags and turn minor bugs into RCE chains.
• Defence is prototype-free objects and rejecting dangerous keys in merges.