← Learn

Definition

What is prototype pollution?

We scanned nearly 2,000 AI-built apps and 1 in 8 shipped a high-severity flaw. Want to check yours?Scan free →

Prototype pollution is a JavaScript vulnerability where an attacker injects a key such as __proto__ or constructor into an object your code copies from untrusted input. Writing through that key modifies Object.prototype, which nearly every object inherits from, so the change leaks into the entire application from a single request.

How it happens

Code that deep-merges or assigns keys from user input into an object, without filtering, will happily copy a key named __proto__. That write reaches the shared prototype, so a property the attacker chose now appears on every object, for example a flag your code later reads and trusts.

How to prevent it

Reject or skip the keys __proto__, constructor, and prototype in any merge or assign over untrusted data, build onto objects created with a null prototype, and validate input against a schema so unexpected keys are dropped. Maintained libraries for deep-merge are already hardened against this.

What this means for AI-generated code

A hand-rolled recursive merge is a common AI-generated utility, and the obvious version copies every key without guarding the dangerous ones. The __proto__ case never appears in normal data, so the missing guard is invisible until someone sends it on purpose.

Want to know if your app has this issue? Scan a public repo free, no account needed.

Scan a repo →

Related: fix an unsafe object merge

What Is Prototype Pollution? The JavaScript Risk, Explained: Prbl