diff --git a/src/lib/util/state.ts b/src/lib/util/state.ts index 429cf736..79f8355a 100644 --- a/src/lib/util/state.ts +++ b/src/lib/util/state.ts @@ -180,6 +180,11 @@ function getUnsafePaths(object: object, unsafeKeys: string[], path: string[] = [ Object.keys(object).forEach((key) => { const value = object[key] as unknown; const currentPath = [...path, key]; + // Prototype pollution check. + if (key.startsWith('__')) { + unsafePaths.push(currentPath); + return; + } if (typeof value === 'object' && value !== null) { unsafePaths.push(...getUnsafePaths(value as object, unsafeKeys, currentPath)); }