PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting prototype pollution in Node without the filesystem

portswigger.net | research | #rce | #web-security | #prototype-pollution | #nodejs | #import-flag | #server-side-prototype-pollution
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A new SSPP exploitation technique: Node's --import flag accepts data: URLs, so polluting NODE_OPTIONS runs arbitrary code without touching the filesystem; Node considers this out of scope.
Published
Collected

Related coverage

research · portswigger.net
Server-side prototype pollution: Black-box detection without the DoS
Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.
vulnerability · yeswehack.com
Server side prototype pollution, how to detect and exploit
Server-side prototype pollution in JavaScript: how prototypes work, how to detect vulnerable targets in black-box testing, and gadget hunting in libraries such as Express, Fastify and Axios.
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
blog · aikido.dev
Preventing prototype pollution in your repository
Prototype pollution causes 20-30% of CVEs in JavaScript/npm stacks and can lead to RCE. The article covers why Node's --frozen-intrinsics isn't ready and how the nopp library mitigates it.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
Critical · advisory · github.com
GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)
Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.
Back