AIKIDO-2026-10415

TL;DR

Affected versions of this package contain a prototype pollution vulnerability in the merge and set functionality, where unsafe handling of __proto__ keys may allow modification of an object’s prototype chain and unintended propagation of attacker-controlled properties across the application. An attacker might exploit this by supplying crafted input containing __proto__ payloads to pollute base objects, potentially altering application logic, bypassing security checks, causing denial of service, or enabling further impact depending on how polluted objects are later used.