Prototype pollution

When it applies

A JS app merges attacker-controlled keys into an object without blocking __proto__ / constructor / prototype. Client-side or Node server-side. Impact needs a "gadget" — code that later reads a polluted property.

Why it works

In JS, every object shares Object.prototype. Writing __proto__.x via a vulnerable merge sets x on every object. A later read of obj.x (that the dev assumed was undefined) now returns your value — turning a config default, an HTML attribute, or a command option to your advantage.