Prototype Pollution

Prototype Pollution is a JavaScript-specific class of vulnerability where an attacker can inject properties into Object.prototype via a crafted key like __proto__ or constructor. Because every JavaScript object inherits from Object.prototype, polluting it affects every object in the runtime — enabling privilege escalation, authentication bypass, or remote code execution depending on how the corrupted properties are later used.

It slips through code review because the dangerous pattern often appears in utility functions — deep merge, recursive assign, path-set — that look perfectly reasonable in isolation. The vulnerability only manifests when those functions receive attacker-controlled input, and the actual exploitation happens somewhere else in the codebase that reads a property from an ordinary object.

PullLight looks for recursive object merge patterns, bracket-notation property assignment from dynamic keys, and JSON.parse results flowing into object merge functions. It flags these with the pollutable path and points to where the polluted property would be consumed.