← All Challenges
Challenge 51 of 66
Prototype Poisoner
🔴 Elite
Web App
+150 XP
A Node.js app deep-merges user input into objects. Pollute Object.prototype to inject isAdmin=true on all objects.
Send {"__proto__":{"isAdmin":true}} in your JSON body.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free