Lab: Remote code execution via server-side prototype pollution

Summary: PortSwigger's lab runs on Node.js and Express and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object, letting an attacker pollute Object.prototype and inject arbitrary system commands. The walkthrough shows a logged-in user adding a __proto__ property with a json spaces value to the POST /my-account/change-address JSON request, confirming the pollution through increased JSON indentation, then polluting execArgv with --eval to reach the execSync() sink when an admin triggers maintenance jobs, producing DNS interactions in Burp Collaborator.
What's compelling: The command execution only fires when an admin triggers the vulnerable maintenance functionality, so a polluted prototype can sit dormant until a privileged user runs routine cleanup tasks. PortSwigger also warns that prototype pollution testing can break application functionality or bring the server down entirely, and that restart option is unlikely to exist on a real site.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026