__proto__ through user input, attackers can alter application behavior, bypass security checks, or achieve remote code execution.Why It Matters for AI-Coded Apps
AI-generated JavaScript code frequently uses object merging and deep copy functions that are vulnerable to prototype pollution. LLMs generate patterns like Object.assign({}, userInput) or custom deep merge functions without filtering __proto__, constructor, or prototype keys from user-controlled data.
Real-World Example
A vibe-coded API merges user preferences with defaults: merge(defaults, req.body). An attacker sends {"__proto__": {"isAdmin": true}}. After the merge, every object in the application inherits isAdmin: true, bypassing authorization checks throughout the entire application.
How to Detect and Prevent It
Use Object.create(null) for dictionary-like objects. Filter __proto__, constructor, and prototype keys from user input. Use Map instead of plain objects for user-controlled key-value data. Freeze prototypes with Object.freeze(Object.prototype) in security-critical contexts. Use proven libraries like lodash (with recent versions that patch prototype pollution).
Frequently Asked Questions
Can prototype pollution lead to RCE?
Does React/Vue prevent prototype pollution?
How do I detect prototype pollution?
__proto__ keys to your API endpoints. Use SAST tools (Semgrep, ESLint with security plugins) to find unsafe merge/clone patterns. Use npm audit and SCA tools to find vulnerable dependencies. Monitor for unexpected object properties in production.