AIKIDO-2026-180874

TL;DR

The email-theming plugin in @react-email/editor builds CSS-in-JS objects from panel-style theme input using plain object literals in transformToCssJs and mergeCssJs. Because these objects inherit from Object.prototype, attacker-controlled keys such as __proto__, constructor, or prototype in the supplied theme or panel-style input route through the prototype setter and mutate Object.prototype globally. This prototype pollution can corrupt application state or influence later logic in the consuming application. The fix builds cssJS and merged theme objects with Object.create(null) and uses defensive merging so hostile keys become plain own properties instead of mutating the global prototype.