From a329954cdd2337f1c3f8d2679464e33a6da200a7 Mon Sep 17 00:00:00 2001
From: soumyadeep765 <soumyadeepdas765@gmail.com>
Date: Fri, 4 Sep 2026 18:10:01 +0530
Subject: [PATCH] src, child_process: fix fatal error on Array prototype
 pollution

Add an object check in ParseStdioOptions to prevent V8 from
crashing with "v8::ToLocalChecked Empty MaybeLocal" when
Array.prototype has been polluted. This replaces the fatal error
with a controlled JavaScript TypeError (ERR_INVALID_ARG_TYPE).

Fixes: #56531

Signed-off-by: soumyadeep765 <soumyadeepdas765@gmail.com>
Assisted-by: Antigravity
---
 src/process_wrap.cc                           |  4 ++++
 ...child-process-array-prototype-pollution.js | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 test/parallel/test-child-process-array-prototype-pollution.js

diff --git a/src/process_wrap.cc b/src/process_wrap.cc
index 4d9420757122..7494b96e9ea9 100644
--- a/src/process_wrap.cc
+++ b/src/process_wrap.cc
@@ -149,6 +149,10 @@ class ProcessWrap : public HandleWrap {
       if (!stdios->Get(context, i).ToLocal(&val)) {
         return Nothing<void>();
       }
+      if (!val->IsObject()) {
+        THROW_ERR_INVALID_ARG_TYPE(env, "options.stdio elements must be objects");
+        return Nothing<void>();
+      }
       Local<Object> stdio = val.As<Object>();
       Local<Value> type;
       if (!stdio->Get(context, env->type_string()).ToLocal(&type)) {
diff --git a/test/parallel/test-child-process-array-prototype-pollution.js b/test/parallel/test-child-process-array-prototype-pollution.js
new file mode 100644
index 000000000000..1f4c8eb581eb
--- /dev/null
+++ b/test/parallel/test-child-process-array-prototype-pollution.js
@@ -0,0 +1,19 @@
+'use strict';
+require('../common');
+const assert = require('assert');
+const { exec } = require('child_process');
+
+Object.defineProperty(Array.prototype, '2', { set: function () {} });
+
+// child_process.exec() used to crash due to missing Array properties from prototype pollution.
+// It should now throw a TypeError from C++ ProcessWrap::ParseStdioOptions instead of a fatal error.
+assert.throws(
+  () => {
+    exec('echo 1');
+  },
+  {
+    code: 'ERR_INVALID_ARG_TYPE',
+    name: 'TypeError',
+    message: /options\.stdio elements must be objects/
+  }
+);