AIKIDO-2025-10314

TL;DR

Affected versions of this package are vulnerable to prototype pollution due to the indirect evaluation of JavascriptCode and JavascriptFunction. It could enable modifications to object prototypes, which, depending on how the application handles the polluted objects, may lead to issues such as denial of service, privilege escalation, or remote code execution. An attacker can exploit a vulnerability by manipulating input to bypass the checks of the indirect evaluation of JavaScript code. By crafting malicious input that evades this check, the attacker can inject arbitrary properties into the prototype chain, resulting in what is known as prototype pollution.