AIKIDO-2025-10889

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution because the skipKeys validation in the object assignment loop did not block the specially crafted properties __proto__, constructor, and prototype. An attacker could exploit this by providing a malicious source object containing these properties, allowing them to pollute the global object prototype and potentially modify the application's behavior, crash the program, or achieve remote code execution.