GitBook: [#3123] No subject

pentesting-web/deserialization/nodejs-proto-prototype-pollution/README.md

@@ -139,6 +139,20 @@ something.constructor.prototype.sayHey = function(){console.log("Hey!")}
 
 After executing that code, **each JS object will be able to execute the function `sayHey`**.
 
+### Array elements pollution
+
+Note that as you can pollute attributes of objects in JS, if you have access to pollute an array you can also **pollute values of the array** accessible **by indexes** (note that you cannot overwrite values, so you need to pollute indexes that are somehow used but not written).
+
+```javascript
+c = [1,2]
+a = []
+a.constructor.prototype[1] = "yolo"
+b = []
+b[0] //undefined
+b[1] //"yolo"
+c[1] // 2 -- not
+```
+
 ## Examples
 
 ### Basic Example