← Back to index

Client-side prototype pollution

Prototype mutation using tainted data.

INLINE-1 (High): location/search → Object.setPrototypeOf
const protoPayload = location.search || '{"admin":true}';
const parsed = JSON.parse(protoPayload || '{}');
Object.setPrototypeOf({}, parsed);