Detecting prototype pollution vulnerabilities in JavaScript using static analysis
-
Updated
Apr 24, 2022 - JavaScript
#
prototype-pollution
Here are 42 public repositories matching this topic...
Secure drop-in replacement for the `JSON` global with prototype pollution protection
-
Updated
Jun 7, 2022 - JavaScript
A scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known gadgets.
xss cybersecurity bug-bounty xss-vulnerability infosec bugbounty xss-exploitation xss-detection bugbounty-tool prototype-pollution
-
Updated
Jun 22, 2022 - Go
Check prototype pollution in JS libraries
-
Updated
Jan 3, 2023 - JavaScript
A website developed with Nodejs. This website includes server side prototype pollution vulnerability
-
Updated
Mar 3, 2023 - CSS
Security Research and PoC
security security-audit research exploit cybersecurity penetration-testing rce vulnerability cve security-tools product-security prototype-pollution log4shell
-
Updated
Mar 7, 2023 - Java
My Write Up for Portswigger Prototype Polution Write Up
-
Updated
Jul 5, 2023
A sample application vulnerable to JavaScript prototype pollution
-
Updated
Nov 8, 2023 - JavaScript
A CTF challenge we put together for Ekoparty's 2023 main CTF
-
Updated
Dec 20, 2023 - HTML
Let's check if your target is vulnerable for client side prototype pollution.
-
Updated
Jan 9, 2024 - Go
Prototype Pollution Checker is a security tool designed to detect potential Prototype Pollution vulnerabilities on target URLs by injecting payloads and verifying responses. This tool uses Selenium to automate browser interactions and concurrently checks multiple URLs for vulnerabilities.
-
Updated
Nov 3, 2024 - Python
A collection of Server-Side Prototype Pollution gadgets and exploits
-
Updated
Feb 6, 2025 - JavaScript
Interactive demo of a prototype pollution → XSS exploit in JavaScript
javascript education security demo exploit xss cybersecurity html-sanitization vulnerability infosec web-security client-side frontend-security interactive-demo prototype-pollution
-
Updated
Apr 12, 2025 - HTML
A tool which helps identifying client-side prototype polluting libraries
security chromium bugbounty vulnerability-scanners security-tools cspp bugbountytips bugbounty-tool prototype-pollution
-
Updated
May 1, 2025 - JavaScript
A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀
rust security chromium bugbounty vulnerability-scanners security-tools rust-tools bugbountytips bugbounty-tool prototype-pollution
-
Updated
Aug 28, 2025 - Rust
Next.js React Server Components RCE exploit for CVE-2025-55182
-
Updated
Dec 5, 2025 - Python
Proof-of-concept research tool for CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router caused by server-side object injection in React Server Components and Server Actions, including UTF-16LE WAF evasion techniques.
react nextjs waf-bypass react-server-components prototype-pollution server-actions utf-16le remote-code-execution-rce cve-2025-55182
-
Updated
Dec 17, 2025 - Python
ProtoScan (protoscan) is a Python CLI that analyzes JavaScript/TypeScript projects for prototype pollution risk. It walks the repo, identifies user-controlled sources, tracks them to unsafe sinks/gadgets, checks dependencies for known CVEs, and outputs findings in JSON/SARIF/HTML/CSV
-
Updated
Jan 10, 2026 - Python
JavaScript Prototype Pollution Attack demo against a NodeJS Express server using Lodash
-
Updated
Feb 1, 2026 - JavaScript
Different unrelated stuff which can not be categorized by qualifying feature
-
Updated
Feb 10, 2026 - JavaScript
Add this topic to your repo
To associate your repository with the prototype-pollution topic, visit your repo's landing page and select "manage topics."