Prototype Pollution occurs when untrusted input is used to add or modify attributes of an object prototype. An adversary can exploit this weakness to create new attributes on all objects (and their descendants) or alter the behaviour of existing ones. In JavaScript, this is typically achieved by manipulating special properties such as __proto__, constructor, or prototype. Exploitation may lead to application logic corruption, denial of service, or escalation into remote code execution depending on how polluted objects are later used.

Remediation

• Explicitly define and allow only trusted properties during object manipulation (use whitelists, not blacklists).
• Validate and sanitise all input before it is used in object property assignment. Reject or escape dangerous keys (__proto__, constructor, prototype).
• Use Object.create(null) for dictionaries or key/value stores to avoid inheriting from Object.prototype.
• Apply hardening by freezing or sealing prototypes (Object.freeze(Object.prototype) or Object.seal) where feasible.
• Regularly update dependencies — many libraries (e.g., lodash, jQuery) have patched historical prototype pollution flaws.