Collected research

GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes

Eric Cornelissen, Mikhail Shcherbakov and Musard Balliu · usenix.org

Studies prototype pollution gadgets inside JavaScript runtimes rather than libraries, arguing that runtime gadgets affect every application executing on them. GHunter, a lightweight dynamic taint analysis built into V8 and driven by the Node.js and Deno test suites, identified 56 new gadgets in Node.js and 67 in Deno, spanning arbitrary code execution, privilege escalation and path traversal, and the paper systematises existing mitigations as development guidance.

Record

Researcher

Eric Cornelissen, Mikhail Shcherbakov and Musard Balliu

Published by

usenix.org

Topic

Injection

In the archive

• Collected in the 2024 research round

Related sources

• USENIX Security '24 - GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes

Tags

• prototype-pollution
• gadget-chain
• nodejs
• javascript-runtime
• dynamic-analysis
• rce
• privilege-escalation
• path-traversal
• tooling
• owasp-a01-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Eric Cornelissen, Mikhail Shcherbakov and Musard Balliu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.