PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Preventing prototype pollution in your repository

aikido.dev | blog | #cloud | #rce | #remediation | #npm | #prototype-pollution | #cve | #aikido | #javascript | #nodejs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Prototype pollution causes 20-30% of CVEs in JavaScript/npm stacks and can lead to RCE. The article covers why Node's --frozen-intrinsics isn't ready and how the nopp library mitigates it.
Published
Collected

Related coverage

blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
blog · aikido.dev
Your CVE is reachable. But is it exploitable?
Any SCA tool worth its salt has reachability analysis these days. When a dependency has a known vulnerability, these tools can tell you whether your code calls the affected function. This is pretty much non-negotiable because it helps teams focus their security efforts instead of sifting through noise. Every other step in prioritizing dependency CVEs builds on it.
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
blog · about.gitlab.com
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
blog · jfrog.com
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
JFrog researchers show how CVSS overstates risk using JavaScript prototype pollution as a case study — Axios gadget chains included — after reassessing 96% of NVD criticals as lower severity.
Back