Prototype Pollution Gadgets Finder
Summary: Doyensec released version 1.0 of the Prototype Pollution Gadgets Finder, a Burp Suite extension that automates scanning of requests to detect and analyze server-side prototype pollution vulnerabilities in web applications. The tool exploits known gadgets, methods of leveraging prototype pollution to execute harmful actions, with particular focus on Node.js libraries; it was last updated 09 October 2024 and is distributed through the BApp Store.
Bottom line: Server-side prototype pollution in Node.js libraries gives an attacker a path from a single polluted object to executing harmful actions, and this extension exists specifically to find those gadget chains in your requests before someone else does.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026