3 ms·

This article is not very good in convincing that prototype pollution is a problem. There was a write up about the kibana rce that really shows it's a problem:

• ble 5y ago
  Thanks for the link, this is a much clearer example of how prototype pollution can be an important vector. As another commenter noted, if one can directly inject literal JS code that writes to __proto__, you've already got RCE. The case where prototype pollution happens without arbitrary RCE looks like: - User input can set arbitrary fields of an object and its properties, allowing the user to add or alter a field on a `__proto__` that references a widely-shared prototype; - The existence or value of that field non-locally affects other code which assumes that the prototype is not under user control.