The Key That Unlocks Everything: Prototype Pollution in JavaScript

Imagine a hotel where every room key is cut from a master template. When a guest checks in, the front desk hands them a key that opens only their room. Simple enough. Now imagine a guest who, during check-in, sneaks a tiny modification into the key-cutting machine itself — changing the template so that every new key cut from that moment on also opens the manager’s office, the safe, and the server room.

The guest didn’t break a lock. They didn’t clone anyone’s key. They changed the factory that makes all keys.

That factory is JavaScript’s Object.prototype. And the attack is called Prototype Pollution.