From 0564db22b0901b4df3ac1bcf88fdef462590477d Mon Sep 17 00:00:00 2001 From: tomaioo Date: Sat, 4 Jul 2026 11:09:28 -0700 Subject: [PATCH] fix(security): potential prototype pollution in p-all.js In workspaces/data/lib/p-all.js, the function uses `Object.entries(promises)` and later `Object.fromEntries(result)`. If user-controlled input is passed as the `promises` object, and the object contains keys like `__proto__`, `constructor`, or `prototype`, this could lead to prototype pollution when `Object.fromEntries` is called. While the current usage may be internal, the function is exported and could be used with untrusted input. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- workspaces/data/lib/p-all.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/workspaces/data/lib/p-all.js b/workspaces/data/lib/p-all.js index b94dded51..11b168b38 100644 --- a/workspaces/data/lib/p-all.js +++ b/workspaces/data/lib/p-all.js @@ -7,6 +7,9 @@ export default async (promises) => { for (const p of promisesArr) { if (isObj) { const [key, value] = p + if (key === '__proto__' || key === 'constructor' || key === 'prototype') { + continue + } if (typeof value === 'function') { result.push(await value().then(v => [key, v])) } else {