dynamoose is vulnerable to prototype pollution. The vulnerability exists through lib/utils/object/set.ts
where an attacker is able to inject properties into existing construct prototypes and modify attributes such as __proto__
, constructor
and prototype
.