Live briefing
Everything about Prototype pollution
Class of web security vulnerabilities
Prototype pollution is a class of vulnerabilities in prototype-based languages such as JavaScript runtimes that allows attackers to overwrite arbitrary properties in an object's root prototype. In a prototype pollution attack, attackers inject properties into existing JavaScript construct prototypes with unsafe merges. Prototype pollution can affect client-side and server-side runtimes. Using prototype pollution to modify properties called by gadgets could lead to Denial of Service (DoS) attacks, code execution, or privilege escalation. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Prototype pollutionA 5-minute orientation
- Skim a recent paper: The Prototype Monitoring System for Pollution Sensing and Online Visualization with the Use of a UAV and a WebRTC-Based PlatformInfluential work since 2022
- Pick up a classic book: Prototype development and test results of a continuous ambient air monitoring system for hydrazine at the 10 ppb levelThe most-reprinted book on the subject
- Read the landmark paper: The trade-off between environmental care and long-term growth—Pollution in three prototype growth modelsCited 251 times
- Go sideways: Code property graphA closely related topic
- Go sideways: JavaScriptA closely related topic
📖 Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
No outline available.
🏆 Landmark papers (most cited)
The trade-off between environmental care and long-term growth—Pollution in three prototype growth models
DAPP: automatic detection and analysis of prototype pollution vulnerability in Node.js modules
Development of Highly Selective and Efficient Prototype Sensor for Potential Application in Environmental Mercury Pollution Monitoring
An integrated web-based air pollution decision support system – a prototype
Prototype of Monitoring Transportation Pollution Spikes through the Internet of Things Edge Networks
Low-Cost Air Purifier Prototype Using a Ventilating Fan and Pump Against Haze Pollution
Evaluation of an innovative approach based on prototype engineered wetland to control and manage boron (B) mine effluent pollution
Solar cars free of environmental pollution—prototype of practically usable car completed
🆕 Influential since 2022
The Prototype Monitoring System for Pollution Sensing and Online Visualization with the Use of a UAV and a WebRTC-Based Platform
Development of improved flow analysis prototype method for measuring and understanding agricultural non-point source (NPS) nitrogen (N) and phosphorus (P) pollution
Detecting prototype pollution for node.js: Vulnerability review and new fuzzing inputs
Innovative prototype for the mitigation of water pollution from microplastics to safeguard the environment and health
Exploitation and prevention of Python prototype chain pollution
📚 Books worth reading
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Code property graph In computer science, a code property graph (CPG) is a computer program representation that captures syntactic structure, control flow, and data dependencies…
- JavaScript JavaScript (JS) is a programming language and core technology of the Web, alongside HTML and CSS. Created by Brendan Eich in 1995, it is maintained by…
- Site isolation Site isolation is a web browser security feature that groups websites into sandboxed processes by their associated origins. This technique enables the…
- Npm npm is a package manager for the JavaScript programming language maintained by npm, Inc., a subsidiary of GitHub. npm is the default package manager for…
- Deno (software) Free and open-source software portal Deno (/diːnoʊ/) is a runtime for JavaScript, TypeScript, and WebAssembly that is based on the V8 JavaScript engine…
- Pixel stealing attack In cybersecurity, pixel stealing attacks are a group of timing side-channel attacks that allow cross-origin websites to infer how a particular pixel is…
- List of JavaScript engines The first JavaScript engines were interpreters of the source code, but modern engines use just-in-time compilation to improve performance. JavaScript engines…
- Node.js Node.js is a cross-platform, open-source JavaScript runtime environment that can run on Windows, Linux, Unix, macOS, and more. Node.js runs on the V8 JavaScript…