#0506
Your build tool reads an external `rawConfig` JSON file and merges it into a fresh object to extract settings like `outputDir`.
The merge uses the same unsafe recursive approach as a popular lodash-era pattern. An attacker who can write `rawConfig` can inject `__proto__.outputDir` to point output at `/etc`, or chain through `constructor.prototype` for a full gadget-chain RCE primitive.
Gadget chains turn prototype pollution from a nuisance into full RCE. Build tools that accept external config files are especially dangerous because they run with elevated privileges and access to the file system.
processConfig({"constructor":{"prototype":{"outputDir":"/etc"}}})// throws: 'Prototype pollution detected'
processConfig({outputDir: '/app/dist'})// returns: {outputDir: '/app/dist'}