BlackFan/client-side-prototype-pollution resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1644 stars · 223 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated collection of JavaScript libraries vulnerable to client-side prototype pollution via document.location parsing, along with useful script gadgets for demonstrating impact. It catalogs payloads, CVEs, and references for security researchers studying this class of web vulnerability.

Use cases

• find libraries vulnerable to client-side prototype pollution
• learn how prototype pollution attacks work in the browser
• demonstrate impact of prototype pollution with script gadgets
• look up CVE payloads for query-string parsing vulnerabilities
• research client-side XSS via prototype pollution
• audit whether a frontend library is on the vulnerable list

When to choose

• you are a security researcher or pentester studying prototype pollution
• you need real-world examples and payloads for a vulnerability report
• you are checking if a query-parsing library has a known pollution CVE

When to avoid

• you need a tool that automatically scans or fixes prototype pollution
• you want a maintained library to include in production code
• you need server-side (Node.js) prototype pollution coverage specifically

Facets

learning-resource · maturity maintenance

security penetration-testing vulnerability-scanning developer-tools security web-development penetration-testing tutorials browser cross-platform prototype-pollution xss script-gadgets client-side-security cve-research vulnerability-examples security-research web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="BlackFan/client-side-prototype-pollution")