thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Prototype Pollution

A JavaScript vulnerability in which attacker input modifies Object.prototype, affecting all objects in the application.

Definition

It arises when code recursively merges or sets properties from untrusted JSON, including keys like __proto__ or constructor.prototype. Impacts range from logic bypass to XSS and server-side RCE. Mitigations include rejecting dangerous keys, using Object.create(null) or Map, freezing prototypes and patched libraries.

Example

A deep-merge utility copies {"__proto__":{"isAdmin":true}} into every object.

Exam tip

JavaScript-specific; block __proto__ and constructor keys in merges.

Related terms