Lab 227 — InsightPulse — Flight Protocol Deserialization to RCE

hackadvisor

Task: InsightPulse analytics platform with custom React Flight protocol parser where recursive merge in the flight decoder does not filter __proto__, enabling prototype pollution. Solution: Pollute Object.prototype.client=true and Object.prototype.escape with IIFE payload via two Flight requests to trigger EJS client+escape gadget chain for RCE, exfiltrating flag via thrown Error.