Prototype pollution

<h2 id="external-links">External links</h2>
<ul><li><a href="https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html">Prototype Pollution Prevention Cheat Sheet - OWASP</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>Li, Song; Kang, Mingqing; Hou, Jianwei; Cao, Yinzhi (2021-08-18). "Detecting Node.js prototype pollution vulnerabilities via object lookup analysis". Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. ESEC/FSE 2021. New York, NY, USA: Association for Computing Machinery. pp. 268–279. doi:10.1145/3468264.3468542. ISBN 978-1-4503-8562-6. <a href="978-1-4503-8562-6" target="_blank">978-1-4503-8562-6</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>Kang, Zifeng; Li, Song; Cao, Yinzhi (2022). "Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites". Proceedings 2022 Network and Distributed System Security Symposium. Reston, VA: Internet Society. doi:10.14722/ndss.2022.24308. ISBN 978-1-891562-74-7. <a href="978-1-891562-74-7" target="_blank">978-1-891562-74-7</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Shcherbakov, Mikhail; Balliu, Musard; Staicu, Cristian-Alexandru (2023). "Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js". SEC '23: Proceedings of the 32nd USENIX Conference on Security Symposium: 5521–5538. arXiv:2207.11171. ISBN 978-1-939133-37-3. <a href="978-1-939133-37-3" target="_blank">978-1-939133-37-3</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
</ol>

Prototype pollution open-in-new

Prototype pollution