AIKIDO-2025-10214

TL;DR

Affected versions of this package are vulnerable to prototype pollution due to unsafe property merging in a for...in loop without hasOwnProperty checks, allowing an attacker to inject malicious properties into Object.prototype by crafting an object with keys like __proto__ or constructor.prototype. It can lead to arbitrary code execution, privilege escalation, or denial of service by polluting the prototype chain.