#vulns.co
/
mcp by GKData.io

← Back to Gadgets

Prototype pollution gadget

Merge/clone/extend of JSON that walks __proto__ or constructor.prototype. Client (lodash, jQuery extend, deepmerge) and server (node merge, qs, body parsers).

Tags: prototype-pollution, xss, rce

Typical severity: P2-P4

What it becomes

Pollution without a gadget is often P4/informational. Pollution plus a sink (innerHTML, template, fetch URL, child_process) is the bug.

Where to look

  • query parsers
  • JSON:API sparse fieldsets
  • config merge from user JSON
  • GraphQL variable objects

Chains

  • XSS — Pollute Object.prototype to turn a safe HTML assignment into a sink (e.g. sanitizer options, script src).
  • RCE — Server-side: pollute env, execPath, shell, or template engine options.

Notes

  • Always show the gadget, not just Object.prototype.x = 1.
  • Node 20+ and modern lodash versions patched many paths; test the actual version in prod JS.

← Back to Gadgets