Imagine you have a game with attacker controlled (x, y): var { x, y } = JSON.parse(input); board[x][y] = true; // ... if (user.admin) ... If the

Imagine you have a game with attacker controlled (x, y): var { x, y } = JSON.parse(input); board[x][y] = true; // ... if (user.admin) ... If the attacker puts: {x: "__proto__", y: "admin"} Then board["__proto__"] might be `object` and then object["admin"] = true Now `<any object>.admin` is true !