I had to look up what prototype pollution is. This post has a good explanation [1]. The attacker construct an object on your server which contains an own-prope

I had to look up what prototype pollution is. This post has a good explanation [1]. The attacker construct an object on your server which contains an own-property '__proto__'. This is straightforward to do if you decode user-supplied JSON (e.g. a REST API) but this alone is not a vulnerability. The vulnerability occurs when you iterate over this object's own-properties and use the resulting keys on another object. If the attacker can arrange for `obj2[key].value =...`, where 'key' is taken from the first object, then they have modified Object.prototype, which affects all other objects. 1: https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/ https://research.securitum.com/prototype-pollution-and-bypas...