bug: unset() can delete from Object.prototype via __proto__ path traversal (missing PROTOTYPE_KEYWORDS guard)

[JSap0914]

Version Number

7.80.0

Steps to reproduce

The unset() utility in src/utils/unset.ts traverses path segments using baseGet() without filtering out prototype-pollution keywords (__proto__, constructor, prototype).

set.ts already guards against this with:

if (PROTOTYPE_KEYWORDS.includes(key)) {
  return;
}

But unset.ts (and its internal baseGet helper) have no equivalent protection. As a result, a path like "__proto__.foo" causes baseGet to walk from the target object into Object.prototype, and the subsequent delete childObject[key] then deletes a property from Object.prototype itself.

import unset from "./src/utils/unset";

// Assume Object.prototype has been extended (e.g. by another library)
Object.prototype.polluted = "SENSITIVE";
console.log({}.polluted); // "SENSITIVE"

unset({}, "__proto__.polluted");

console.log({}.polluted); // undefined — deleted from the prototype!

Expected behaviour

unset() should ignore (no-op) any path that contains __proto__, constructor, or prototype, consistent with the protection already present in set.ts.

Root cause

unset.ts:baseGet traverses path segments unconditionally:

function baseGet(object: any, updatePath: (string | number)[]) {
  // ...
  while (index < length) {
    object = object[updatePath[index]]; // ← no prototype keyword check
    index++;
  }
  return object;
}

stringToPath("__proto__.polluted") → ["__proto__", "polluted"].
baseGet then dereferences object["__proto__"] → Object.prototype.
delete Object.prototype["polluted"] follows.

set.ts guards the equivalent traversal loop, but unset.ts was not updated to match.

What browsers are you seeing the problem on?

All (Node.js repro confirmed)

Code of Conduct

• I agree to follow this project's Code of Conduct