Prototype pollution: poisoning Object.prototype

In JavaScript every object inherits from Object.prototype. If a recursive merge or parser writes a __proto__ key from user input, it pollutes the prototype shared by all objects.

The mechanism

merge({}, JSON.parse('{"__proto__":{"isAdmin":true}}'))
({}).isAdmin   // true  -> every object now has isAdmin

Consequences depend on the code: check bypass (if (user.isAdmin)), DoS, and in the right conditions RCE (a polluted property flowing into child_process or a template).

Defence

Do not blindly recursive-merge untrusted input. Block the keys __proto__, constructor, prototype. Use Object.create(null) for data maps, Map instead of objects, Object.freeze(Object.prototype). Libraries with known guards (up-to-date lodash).