AIKIDO-2025-10884

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution due to insufficient validation of user input when merging properties, specifically because the constructor property was not blocked alongside __proto__, allowing an attacker to inject properties into Object.prototype by crafting an object with a constructor property that points to an Object prototype, which can then be used to manipulate the prototype property of a newly created object and pollute the prototype chain, potentially leading to denial of service, bypassing security checks, or remote code execution.