AIKIDO-2025-10985

TL;DR

Affected versions of this package are vulnerable to Prototype Pollution vulnerability in the setByDotNotation utility function, where the lack of validation for user-controlled dot-notation paths allows an attacker to exploit it by injecting dangerous keys like __proto__, constructor, or prototype to mutate Object.prototype, potentially leading to Denial of Service (DoS), logic bypasses, or even Remote Code Execution (RCE).