Here’s a simple example of how prototype pollution works.

Read more of the latest JavaScript security news And once you make a change to object, it applies to all JavaScript objects in a running application, including those created after tampering. Interestingly, attackers don’t even need to directly modify object – they can access it through the ‘ _proto_’ property of any JavaScript object. Malicious actors can make application-wide changes to all objects by modifying object, hence the name prototype pollution. Object-based inheritance gives JavaScript the flexibility and efficiency that web programmers have come to love – but it also makes it vulnerable to tampering. JavaScript is prototype-based: when new objects are created, they carry over the properties and methods of the prototype “object”, which contains basic functionalities such as toString, constructor and hasOwnProperty. The security hole was a prototype pollution bug – a type of vulnerability that allows attackers to exploit the rules of the JavaScript programming language and compromise applications in various ways. In early 2019, security researchers at Snyk disclosed details of a severe vulnerability in Lodash, a popular JavaScript library, which allowed hackers to attack multiple web applications. A new class of security flaw is emerging from obscurity

Javascript prototype