Prototype Pollution

The attack exploits JavaScript's prototype-based inheritance model. By injecting properties into Object.prototype or other built-in prototypes, an attacker can poison every object in the runtime. This is typically achieved through unsafe recursive merge, clone, or path-setting functions that fail to filter __proto__ or constructor.prototype keys. Once polluted, all newly created or existing objects inherit the malicious property, enabling universal runtime manipulation.

Prototype pollution manifests through several critical pathways in AI applications:

• Unsafe Deep Merge: Recursive merging of user-supplied JSON without sanitizing __proto__ keys
• Path-Based Property Setting: Libraries like lodash.set or dot-prop that allow bracket-notation traversal to __proto__
• URL Query Parsing: Parsers that naively convert query parameters like ?__proto__[isAdmin]=true into nested objects
• GraphQL Argument Injection: Complex nested input types that traverse to prototype properties during resolver execution

In Node.js-based AI inference servers, prototype pollution can have catastrophic consequences:

• Model Deserialization Bypass: Polluting properties used during model loading to skip integrity checks
• Prompt Injection Amplification: Setting default properties that alter how user prompts are processed or sanitized
• Authentication Bypass: Injecting isAdmin: true or role: 'admin' into the prototype, granting unauthorized access to model endpoints
• Denial of Service: Overwriting critical functions like toString or valueOf to crash the inference server on every request

Identifying prototype pollution requires both static and dynamic analysis:

• Runtime Object Inspection: Periodically checking Object.prototype for unexpected enumerable properties using Object.keys(Object.prototype)
• Freezing Primitives: Applying Object.freeze(Object.prototype) early in the application lifecycle to block pollution attempts
• Static Analysis Rules: Scanning for unsafe patterns like obj[key][prop] = value without hasOwnProperty checks
• Dynamic Taint Tracking: Instrumenting the runtime to flag when user-controlled input reaches prototype assignment operations

Defense-in-depth against prototype pollution in AI systems:

• Schema Validation: Enforce strict JSON Schema validation on all user input, rejecting __proto__, constructor, and prototype keys
• Safe Merge Utilities: Use libraries with prototype pollution protection or implement hasOwnProperty guards in custom merge functions
• Map Over Plain Objects: Prefer Map data structures for key-value storage where keys are user-controlled, as Maps lack prototype chains
• Node.js Security Flags: Enable --disable-proto=delete to remove __proto__ access entirely, or use Object.create(null) for dictionary objects

A classic payload demonstrates the attack's simplicity:

codeCopy
{
  "__proto__": {
    "isAdmin": true,
    "allowedModels": ["*"]
  }
}

When merged into an AI gateway's configuration object, this payload sets isAdmin and allowedModels on Object.prototype. Every subsequent object access—including user session objects and model authorization checks—inherits these values, granting unrestricted access to all deployed models without authentication.