__proto__ attack example

ProtoAttack.js

// has the Object prototype
const someObject = {};

// request input is parsed
const maliciousInput = JSON.parse('{ "__proto__": { "toString": "xxx" } }');

// somewhere a bad copy or merge library is used which copies ALL properties including __proto__
someObject.__proto__.toString = maliciousInput.__proto__.toString;

// at some other place
const someOtherObject = {};
console.log(someOtherObject.toString()); // crashes