John-David Dalton abbc90df65 Fix prototype pollution in _.unset and _.omit (#6065) ...

Prevent prototype pollution on baseUnset function by:
- Blocking "__proto__" if not an own property
- Blocking "constructor.prototype" chains (except when starting at primitive root)
- Skipping non-string keys

See: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg

2025-12-10 07:53:08 -05:00

1.8 KiB

Raw Permalink Blame History

View Raw