{"id":"e46aaff171592b91","repo":"sequelize/sequelize","slug":"prototype-pollution-attempt-detected-in-key-key","errorCode":null,"errorMessage":"Prototype pollution attempt detected in key: ${key}","messagePattern":"Prototype pollution attempt detected in key: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/utils/undot.ts","lineNumber":48,"sourceCode":"\n/**\n * Tokenize a single flat path like: \"a.b[0].c\"\n * - Dots split object keys\n * - Brackets with digits create numeric array indices\n * - Does NOT implement escaping / quoted keys; keep keys simple for max perf\n *\n * @param key The flat key to tokenize\n */\nexport function tokenizePath(key: string): PathSeg[] {\n  const out: PathSeg[] = [];\n  let i = 0;\n  const n = key.length;\n  let buf = '';\n\n  const flushBuf = () => {\n    if (buf.length) {\n      if (isDangerousSegment(buf)) {\n        throw new Error(`Prototype pollution attempt detected in key: ${key}`);\n      }\n\n      out.push(buf);\n      buf = '';\n    }\n  };\n\n  while (i < n) {\n    // disable linting rule for performance.\n    /* eslint-disable-next-line unicorn/prefer-code-point */\n    const ch = key.charCodeAt(i);\n    if (ch === 46 /* '.' */) {\n      flushBuf();\n      i++;\n      continue;\n    }\n\n    if (ch === 91 /* '[' */) {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/sequelize/sequelize/blob/7e1deec499d5afbb8d1877c2f4d545cead1214ec/packages/core/src/utils/undot.ts#L30-L66","documentation":"Error \"Prototype pollution attempt detected in key: ${key}\" thrown in sequelize/sequelize.","triggerScenarios":"A key passed to undot contains a prototype-polluting segment such as __proto__.","commonSituations":"Unsanitized user input used as attribute paths.","solutions":["Do not use __proto__, constructor, or prototype as keys in dotted attribute paths; validate/sanitize user input used to build keys."],"exampleFix":"const safe = key.replace(/(^|\\.)(__proto__|constructor|prototype)(\\.|$)/g, '_');","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"7e1deec499d5afbb8d1877c2f4d545cead1214ec","analyzedAt":"2026-08-03T18:58:44.549Z","schemaVersion":2}