AIKIDO-2026-10046

TL;DR

Affected versions of the package are vulnerable to prototype pollution issues in the transport loading mechanism due to unsafe access to globalThis.__bundlerPathsOverrides. The use of the in operator and a default {} object allows prototype chain manipulation, which can influence transport resolution logic. This can be abused by an attacker to alter application behavior. The fix hardens the implementation by using Object.prototype.hasOwnProperty.call() and a prototype-less fallback object to prevent prototype chain pollution.