Hi @andersk ,

Thank you for your feedback regarding the report. I would like to highlight an additional prototype accessor: constructor.prototype. A potential injection could look like this:

extend ({}, JSON.parse('{"constructor":{"prototype":{"polluted":yes}}}'))"

Checking for the presence of constructor in the input should be sufficient.

Best,
Tariq

Checking for the presence of constructor in the input should be sufficient.

Nope, it’s not.

extend({}, {"hasOwnProperty": {"polluted": "yes"}});
console.log(Object.prototype.hasOwnProperty.polluted); // → yes

I’ve pushed a more complete fix.

Please merge this fix as it's a severity score is high.