AIKIDO-2026-10079

TL;DR

Affected versions of this package are vulnerable to prototype pollution via the applicationData API, where unvalidated, user-controlled paths passed to _.set() and JSON Patch operations could include dangerous segments like __proto__, constructor, or prototype, allowing an attacker to manipulate the object prototype and potentially alter application behaviour or gain unauthorized access; the issue is fixed by adding validation to block such prototype pollution paths and returning a 400 response when they are detected, preventing exploitation.