Lab 385 — SprintForge — Prototype Pollution to RCE via React Flight Protocol

hackadvisor

Task: Next.js 15.2 agile project management app using React Server Actions via Flight Protocol with unsafe deep merge on settings payload. Solution: Prototype pollution via __proto__.shell in multipart form field triggers RCE through notification dispatch system, leaking FLAG from environment variables.