Thanks for the link, this is a much clearer example of how prototype pollution can be an important vector. As another commenter noted, if one can directly inje

Thanks for the link, this is a much clearer example of how prototype pollution can be an important vector. As another commenter noted, if one can directly inject literal JS code that writes to __proto__, you've already got RCE. The case where prototype pollution happens without arbitrary RCE looks like: - User input can set arbitrary fields of an object and its properties, allowing the user to add or alter a field on a `__proto__` that references a widely-shared prototype; - The existence or value of that field non-locally affects other code which assumes that the prototype is not under user control.