AIKIDO-2025-10941

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution via the extend() helper function due to insufficient validation when merging objects; an attacker could exploit this by passing a malicious object containing properties like __proto__, prototype, or constructor to merge operations, potentially allowing them to modify the Object prototype and inject or alter properties that exist on all objects, leading to unexpected behavior, denial of service, or remote code execution in the worst-case scenario, which was mitigated by adding validation to skip these reserved properties during extension.