Why Cursor Generates Prototype Pollution in Deep Merge Functions

Short summary

Cursor generated a deep merge function that was vulnerable to prototype pollution (CWE-1321), allowing a crafted payload to overwrite Object.prototype and compromise the entire Node process. The root cause is that training data overwhelmingly contains functional but unsafe merge snippets lacking key guards. The fix is a three-key guard skipping __proto__, constructor, and prototype before recursion.

• •AI editors generate prototype-pollutable merge functions because training data rarely includes safety guards
• •A single crafted payload can poison Object.prototype for the entire Node process until restart
• •Fix: skip __proto__, constructor, and prototype keys at the top of the recursion loop

Generated with AI, which can make mistakes.