AIKIDO-2026-107994

TL;DR

The @tanstack/db query select compiler builds result objects by splitting each select() alias on . and walking the segments into a nested object. Alias segments such as __proto__, prototype, or constructor are not filtered, so an alias like __proto__.polluted writes through to Object.prototype and pollutes it for the rest of the process. Any public entry point that compiles a select, such as queryOnce or createLiveQueryCollection, can trigger this when an application uses untrusted input as an alias path. The fix rejects unsafe alias path segments during select compilation with a new UnsafeAliasPathError.