Other nomination
Prototype Pollution in Python
Prototype pollution has a Python equivalent: a recursive merge or a pydash set_ call that walks attacker-supplied keys onto an object reaches special attributes such as __class__, __base__, __globals__ and __kwdefaults__. That lets an attacker rewrite shared parent-class attributes, module globals, function keyword defaults and os.environ entries like COMSPEC, escalating to command execution.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.