AIKIDO-2026-523264

TL;DR

The es-toolkit/compat path-writing functions such as set, setWith, update, updateWith, and zipObjectDeep resolve nested property paths when assigning a value. Before the fix the shared write path blocked only __proto__, so a path that traversed constructor.prototype was followed into Object.prototype. A nested path such as constructor.prototype.polluted could therefore add or overwrite properties on the global object prototype, affecting every object in the runtime. The fix rejects __proto__, constructor, and prototype segments on the write path so these keys can no longer be traversed during assignment.