AIKIDO-2026-925158

TL;DR

The unset utility in react-hook-form traverses nested path segments through an internal helper without filtering prototype-related keywords such as __proto__, constructor, and prototype. A path that includes one of these keywords causes the traversal to walk into Object.prototype, and the following delete operation removes a property from the prototype itself. An equivalent guard already existed in the set utility but was missing from unset, so callers could delete prototype properties through crafted field paths. The fix returns early as a no-op when any path segment is a prototype keyword.