Exploiting prototype pollution in Node without the filesystem
Summary: PortSwigger researcher Gareth Heyes documented a new server-side prototype pollution exploitation technique that uses Node's --import command line flag, available from Node 19.0.0, to load a data: URL module and execute arbitrary JavaScript without placing any file on the filesystem. Heyes reported the NODE_OPTIONS behavior to the Node developers, who decided it was "not an entrypoint security issue" and did not violate their threat model.
Why it matters: The usual SSPP-to-RCE path through fork() depends on --require and the filesystem or environment variables; --import removes the local-file requirement, so a leader whose detection assumes file drops will miss this route entirely.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026