AIKIDO-2025-10930

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution via Unsafe Property Access due to the lack of proper validation when retrieving object properties, allowing an attacker to access unsafe inherited prototype properties such as constructor or __proto__. It occurs in code paths that directly access user-supplied property names on objects without using proper validation. By manipulating these property accesses, an attacker can potentially obtain references to fundamental object constructors, leading to prototype pollution, remote code execution, or a breach of the sandbox environment by chaining these constructors to execute arbitrary code.