Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the zodCoerceInternal function in coercer.ts Zod 3 and the coerce method in zod4/coercer.ts Zod 4, which are used by ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin respectively. Both plugins coerce...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via JsonSchemaCoercercoerce in coercer.ts, where attacker-controlled keys from untrusted input are processed before validation by the SmartCoercionPlugin. Wh...