AIKIDO-2025-10346

TL;DR

Affected versions of this package are vulnerable to prototype pollution due to inadequate validation of object keys. Although forbidden keys are validated, this check can be bypassed with a nested object containing those keys. An attacker could exploit this by crafting a JSON payload that pollutes the prototype chain, allowing them to inject properties into all objects in the application, potentially leading to remote code execution or other security issues.