exploiting-prototype-pollution-in-javascript

Detect and test prototype pollution vulnerabilities in JavaScript applications.

2|Updated Apr 14, 2026

Search Tags:#xss #javascript #web-security #rce #prototype-pollution #security-testing #node-js

Ready to run

npx skills add https://github.com/Acczdy/MoZiSec --skill exploiting-prototype-pollution-in-javascript

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: exploiting-prototype-pollution-in-javascript
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/exploiting-prototype-pollution-in-javascript
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill exploiting-prototype-pollution-in-javascript

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

## What problem does it solve? Detect and test prototype pollution vulnerabilities in JavaScript applications.

## Core Features & Use Cases

Client-side pollution detection via URL parameters and JSON bodies.
Server-side gadget testing across common template engines and merge patterns.
Remediation guidance and risk assessment for production systems.

### Quick Start Run the agent against a target URL or scan a local JavaScript file containing prototype pollution logic.

Frequently Asked Questions about exploiting-prototype-pollution-in-javascript

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for prototype pollution in JavaScript applications?▼

To test for prototype pollution in JavaScript applications, scan target URLs or local JS files for vulnerable deep-merge gadget paths using URL parameters and JSON bodies to identify sources, sinks, and assess gadget viability.

What is prototype pollution and how does it affect web security?▼

Prototype pollution is a web security vulnerability where attackers inject properties into JavaScript object prototypes. It affects web security by enabling Cross-Site Scripting (XSS) or Remote Code Execution (RCE) through compromised client-side and server-side merge patterns.

Can I detect server-side prototype pollution gadgets in Node.js?▼

Yes, you can detect server-side prototype pollution gadgets in Node.js by testing target URLs and JSON bodies against common deep-merge patterns and template engines to assess gadget viability and identify vulnerable code.

Does prototype pollution testing work for both client-side and server-side contexts?▼

Prototype pollution testing works for both client-side and server-side contexts. It detects vulnerable patterns via URL parameters and JSON bodies, identifying sources and sinks across the entire JavaScript application stack.

What is the best way to remediate prototype pollution vulnerabilities?▼

The best way to remediate prototype pollution vulnerabilities is to scan code for vulnerable deep-merge patterns and utilize generated remediation recommendations to block malicious property injection at the source before production deployment.

Why does prototype pollution scanning fail to find vulnerable gadget paths?▼

Prototype pollution scanning might fail to find vulnerable gadget paths if the target JavaScript application uses non-standard deep-merge implementations or sanitizes URL parameters and JSON bodies before processing them.