From 5a7c5b8410e426ac6412bfaaae513174df3fea57 Mon Sep 17 00:00:00 2001 From: Matthias Kunnen Date: Tue, 21 Jul 2020 03:29:04 +0000 Subject: [PATCH] Fix prototype pollution on unflatten Fixes #105. --- index.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/index.js b/index.js index ca8904a..31afb76 100644 --- a/index.js +++ b/index.js @@ -77,6 +77,9 @@ function unflatten (target, opts) { var recipient = result while (key2 !== undefined) { + if (key1 === '__proto__') { + return + } var type = Object.prototype.toString.call(recipient[key1]) var isobject = ( type === '[object Object]' ||