AIKIDO-2026-130946

TL;DR

The Assembler component rebuilds JavaScript objects from the parsed token stream and assigns each key with this.current[this.key] = value. When parsed input contains a __proto__ key, this assignment invokes the inherited prototype setter and replaces the object's prototype with parsed content instead of creating an own property. Code that later reads properties through the prototype chain can then observe injected values, unlike native JSON.parse(). The fix defines __proto__ as an own data property so parsed keys never mutate the prototype.