---
id: 5452
title: "Exploiting prototype pollution in Node without the filesystem"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/exploiting-prototype-pollution-in-node-without-the-filesystem"
published_at: "2023-03-23T15:00:00Z"
tags: ["rce", "web-security", "prototype-pollution", "nodejs", "import-flag", "server-side-prototype-pollution"]
phying_url: "https://phying.com/item/5452"
lang: en
---

# Exploiting prototype pollution in Node without the filesystem

## Summary

A new SSPP exploitation technique: Node's --import flag accepts data: URLs, so polluting NODE_OPTIONS runs arbitrary code without touching the filesystem; Node considers this out of scope.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-03-23T15:00:00Z
- **Original:** https://portswigger.net/research/exploiting-prototype-pollution-in-node-without-the-filesystem
- **Phying News:** https://phying.com/item/5452