AIKIDO-2026-719451

TL;DR

The delete and set utilities walk a caller-supplied dotted property path and traverse into each path component without fully rejecting dangerous keys. When a path such as __proto__.toString, constructor, or prototype is supplied, traversal reaches and mutates Object.prototype, polluting the global prototype chain. This can corrupt object behavior application-wide and cause denial of service, and may escalate to further injection depending on how the polluted properties are later consumed. The fix rejects __proto__, constructor, and prototype path components in both delete and set before any traversal occurs.