Prototype pollution is a class of vulnerabilities in prototype-based languages such as JavaScript runtimes that allows attackers to overwrite arbitrary properties in an object's root prototype. In a prototype pollution attack, attackers inject properties into existing JavaScript construct prototypes with unsafe merges. Prototype pollution can affect client-side and server-side runtimes. Using prototype pollution to modify properties called by gadgets could lead to Denial of Service (DoS) attacks, code execution, or privilege escalation.
References
External links Prototype Pollution Prevention Cheat Sheet - OWASP