AIKIDO-2025-10349

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution in multiple operations (delete, deleteMany, updateMany) due to insufficient validation of user-supplied input, allowing attackers to inject malicious properties like __proto__. An attacker could exploit this by manipulating these operations to modify the prototype of base objects, potentially leading to arbitrary code execution, denial of service, or privilege escalation.