vetkit.js.prototype-pollution.request-key
A request value is used as the first key of a nested property assignment (obj[key][prop] = value). A key of __proto__ or constructor modifies Object.prototype for the whole process (prototype pollution).
Last updated:
Suite: Security
javascript, typescript
A request value is used as the first key of a nested property assignment (obj[key][prop] = value). A key of __proto__ or constructor modifies Object.prototype for the whole process (prototype pollution).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Reject __proto__, constructor and prototype keys, use a Map or an object created with Object.create(null), or check membership with Object.hasOwn against an allow-list.
References
Source: packages/engine/rules/sast/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.