prototype-pollution

Test JavaScript prototype pollution by sending payloads containing __proto__ or constructor.prototype via query-string parsing, JSON bodies, or deep merge functions, then issuing a clean follow-up request to verify if global side effects persist.

Prototype pollution occurs during deep merge operations when untrusted input with recursive assignment of nested keys is merged into JavaScript objects, corrupting object prototypes and enabling logic manipulation or RCE gadget execution.

Verify remote code execution by mapping observed prototype pollution to likely polluted sinks and gadget patterns, such as template options, expression chains, or child_process-style option usage within the JavaScript application framework.

Query-string parsing exposes applications to prototype pollution risks when untrusted input is recursively assigned into objects via deep assign, allowing __proto__ or constructor.prototype keys to corrupt JavaScript object prototypes.

The difference between __proto__ and constructor.prototype pollution paths lies in the specific JavaScript object prototype chains targeted, and bypasses may miss one key variant, requiring separate testing for comprehensive vulnerability coverage.

Escalate prototype pollution likelihood during security testing when observing deep merges, recursive assignment, and nested key handling in common JavaScript libraries, as these mechanisms indicate higher probability of untrusted input corrupting object prototypes.