You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Class pollution** is a vulnerability pattern in which an attacker traverses Python's
11
-
runtime object graph through dunder attributes —`__class__`, `__init__`,
12
-
`__globals__`, `sys.modules`, and so on — and overwrites attributes in unintended
13
-
classes, functions, or modules. The traversal is driven by a reflective
14
-
`getattr`/`setattr` (or `__getitem__`/`__setitem__`) loop whose path or keys come from
15
-
untrusted input.
10
+
**Class pollution** is a vulnerability class where an attacker traverses Python's runtime object graph through dunder attributes such as `__class__`, `__init__`, `__globals__`, and `sys.modules`, and overwrites attributes in unintended classes, functions, or modules. The traversal is driven by a reflective attribute or item access loop whose path or keys come from untrusted input.
16
11
17
-
It is the Python analogue of JavaScript prototype pollution[^silvanovich2021], but the
18
-
primitives are richer: because Python's object model is class-based with a flexible
19
-
reflection layer, pollution can reach classes, functions, modules, and even descriptor
20
-
slots — not just a single root prototype.
12
+
It is the Python analogue of [JavaScript prototype pollution][jsproto], but the primitives are richer: Python's class-based object model with a flexible reflection layer lets pollution reach classes, functions, modules, and descriptor slots.
21
13
22
-
## A motivating example
14
+
## Roadmap
23
15
24
-
```python
25
-
defupdate(user, data):
26
-
for key in data:
27
-
val = data[key]
28
-
ifisinstance(val, dict):
29
-
update(getattr(user, key), val)
30
-
else:
31
-
setattr(user, key, val)
32
-
```
16
+
This wiki is organized into the following sections. Most readers can pick the entry point that matches their goal:
33
17
34
-
The function looks like a routine deep-merge of nested form data onto a model object. But
35
-
because `getattr` does not distinguish between developer-defined attributes and dunder
36
-
attributes, an attacker-controlled `data` can step through Python's object graph:
18
+
<!-- - **[Taxonomy]({{< relref "taxonomy" >}})**: the systematic taxonomy of class pollution along three aspects: pollution primitives, vulnerability types, and consequences.
19
+
- **[Pollution Targets]({{< relref "targets" >}})**: runtime objects (classes, modules, functions, globals) that are reachable via reflection and meaningfully change program behavior when modified.
20
+
- **[Gadgets]({{< relref "gadgets" >}})**: concrete target + value combinations that turn a pollution primitive into RCE, XSS, authentication bypass, DoS, or token leakage.
21
+
- **[Tool]({{< relref "tool" >}})**: documentation for *Pyrl* (the detection tool, built on operational taint analysis over CodeQL) and *Polluter* (an exploitation/testing helper).
22
+
- **[Collection]({{< relref "collection" >}})**: a curated database of confirmed vulnerable Python packages with end-to-end PoCs, including the assigned CVEs and showcase walkthroughs.
23
+
- **[Defense]({{< relref "defense" >}})**: mitigations along the object resolution path: key sanitization at the "get" primitive and guards at the "set" primitive. -->
37
24
38
-
```json
39
-
{"__class__": {"__getattribute__": "1337"}}
40
-
```
25
+
## About this wiki
41
26
42
-
After this call, `type(user).__getattribute__` is the string `"1337"`. Any attribute
43
-
access on any instance of the `User` class now raises `TypeError: 'str' object is not
44
-
callable` — a denial-of-service primitive. Extending the path through
45
-
`__init__.__globals__.sys.modules` reaches any imported module, which is where the
This wiki accompanies our IEEE S&P 2026 paper [*The First Large-Scale Systematic Study of Python Class Pollution Vulnerability*][paper]. Its goal is to be a living reference for the vulnerability class. Concretely, we want it to:
49
28
50
-
## Reading guide
29
+
- Document the taxonomy, targets, and gadgets in a way that is easier to extend than a PDF.
30
+
- Track new CVEs, gadgets, and showcases as they are discovered.
31
+
- Provide actionable defense guidance for library and application maintainers.
51
32
52
-
Different audiences read this wiki differently. Start here:
33
+
## Contributions
53
34
54
-
-**Security researchers** looking to understand the vulnerability class:
- Critical findings in Microsoft Azure CLI, Google Mesop, Taipy, django-unicorn, ComfyUI,
111
-
Hugging Face Diffusers, and others.
112
-
113
-
## Related work
114
-
115
-
-**JavaScript prototype pollution** was first documented by Olivier Arteau in 2018 and
116
-
systematized by Silvanovich and others[^silvanovich2021]. The object-model differences
117
-
above mean the Python variant is not a mechanical port.
118
-
-**`pydash` gadget** (2022): [@abdulrah33m] published the first public demonstration of a
119
-
dunder-walk gadget in Python via `pydash.set_`.
120
-
-**`deepdiff` advisory** ([CVE-2024-5254][deepdiff-cve], by [@chilaxan][chilaxan]): the
121
-
first CVE issued for a Python reflective-merge sink.
122
-
-**Pyrl** (this work, IEEE S&P 2025[^paper]): the first automated detector, built on an
123
-
operational taint-analysis extension of CodeQL's Python support.
35
+
Contributions are welcome: new gadgets, additional showcases, corrections, and translations. The site is built with Hugo from markdown sources under [`website/source/`](https://github.com/jackfromeast/python-class-pollution/tree/main/website/source). To propose a change, open an [issue](https://github.com/jackfromeast/python-class-pollution/issues) or a [pull request](https://github.com/jackfromeast/python-class-pollution/pulls) on the repo: https://github.com/jackfromeast/python-class-pollution.
124
36
125
37
## References
126
38
127
-
[^silvanovich2021]: Natalie Silvanovich. *The Risks of JavaScript Prototype Pollution*.
1. Abdulraheem Khaled, *"Prototype Pollution in Python."* 2023. [Link](https://blog.abdulrah33m.com/prototype-pollution-in-python/). Also presented at Black Hat MEA 2023, [Link](https://blackhatmea.com/session/prototype-pollution-bug-python).
40
+
2. Ziyi Ouyang, *"Research and Explore of Prototype Pollution Attack in Python."* ACCTCS 2023. [Link](https://ieeexplore.ieee.org/abstract/document/10145365).
41
+
3. Qingyun Zhang, *"Exploitation and prevention of Python prototype chain pollution."* Applied and Computational Engineering,43,229-236. [Link](https://doi.org/10.54254/2755-2721/43/20230839).
42
+
4. Zhengyu Liu, Jiacheng Zhong, Jianjia Yu, Muxi Lyu, Zifeng Kang, Yinzhi Cao, *"The First Large-Scale Systematic Study of Python Class Pollution Vulnerability."* IEEE S&P 2026. [Link](https://jackfromeast.github.io/assets/Pyrl.pdf).
0 commit comments