Server-side prototype pollution to RCE in Node

If user input reaches a recursive merge or JSON to object assignment, you can set properties on Object.prototype that downstream code reads as its own options.

{"__proto__":{"shell":"/proc/self/exe","argv0":"node","NODE_OPTIONS":"--require /tmp/x.js"}}

Later, any child_process.spawn that does not pass those options explicitly inherits the polluted defaults.

// gadget that fires: unrelated code spawns a process
const { execSync } = require('child_process');
execSync('ls'); // picks up polluted NODE_OPTIONS / env, runs /tmp/x.js

Pro note: find the sink with a pollution scanner, then map to a concrete gadget in the app’s dependency tree (ejs, lodash templates, and spawn options are common). Report the exact gadget, not just that prototype writes are possible; triagers reject theoretical pollution.