AIKIDO-2026-449141

TL;DR

EntityAssigner.assign(), which backs the assign() APIs such as wrap(entity).assign(data), em.assign(entity, data), and entity.assign(data), iterates over the keys of the supplied data without ignoring __proto__, constructor, and prototype. Those keys resolve to inherited accessors on Object.prototype, so they are not treated as unknown properties and are written through to the entity, and a __proto__ key reassigns the prototype of that single entity instance. Applications that pass unvalidated user input directly to an assign() API can have the affected instance corrupted so that instanceof and inherited methods stop resolving, causing unexpected exceptions or a denial of service scoped to that instance. The fix ignores __proto__, constructor, and prototype keys at the top level and inside embeddables.