From fe983e97a2e67f118beb71fa916ea68d36de10a1 Mon Sep 17 00:00:00 2001 From: zayeem shaikh Date: Wed, 1 Jul 2026 12:03:17 +0530 Subject: [PATCH] reject prototype-polluting segments in path set --- lib/utils/path.js | 9 +++++++++ test/unit/path.html | 14 +++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/lib/utils/path.js b/lib/utils/path.js index 52fda93c45..4da5d990f4 100644 --- a/lib/utils/path.js +++ b/lib/utils/path.js @@ -218,6 +218,15 @@ export function set(root, path, value) { let prop = root; let parts = split(path); let last = parts[parts.length-1]; + // Refuse to traverse or write through keys that resolve to the prototype + // chain, otherwise a path such as `__proto__.x` or `constructor.prototype.x` + // mutates `Object.prototype` instead of `root`. + for (let i=0; i 1) { // Loop over path parts[0..n-2] and dereference for (let i=0; i