Prototype pollution is a kind of severe vulnerability in Node.js that enables unauthorized modification of object prototypes, leading to critical security risks.Although prior work has focused on detecting and assessing the severity of prototype pollution, automated and efficient exploit generation for server-side scenarios remains unaddressed.To bridge this gap, we develop AePPollo 1 , a framework that integrates taint analysis, knowledge-enhanced Large Language Models (LLMs), and fuzzing to automatically generate exploits for Node.jsprototype pollution.Evaluated on 218 real-world prototype pollution vulnerabilities, AePPollo achieves a 91.74% exploit generation success rate with minimal overhead, outperforming state-of-theart methods.

Node.js applications are becoming more and more widely adopted on the server side, partly due to the convenience of building these applications on top of the runtime provided by popular Node.js engines and the large number of third-party packages provided by the Node Package Management (npm) registry. Node.js provides Node.js applications with system interaction capabilities using system calls. However, such convenience comes with a price, i.e., the attack surface of JavaScript arbitrary code execution (ACE) vulnerabilities is expanded to the system call level.