sequelize/sequelize · error · Error

Prototype pollution attempt detected in key: ${key}

Error message

Prototype pollution attempt detected in key: ${key}

What it means

Error "Prototype pollution attempt detected in key: ${key}" thrown in sequelize/sequelize.

Source

Thrown at packages/core/src/utils/undot.ts:48

/**
 * Tokenize a single flat path like: "a.b[0].c"
 * - Dots split object keys
 * - Brackets with digits create numeric array indices
 * - Does NOT implement escaping / quoted keys; keep keys simple for max perf
 *
 * @param key The flat key to tokenize
 */
export function tokenizePath(key: string): PathSeg[] {
  const out: PathSeg[] = [];
  let i = 0;
  const n = key.length;
  let buf = '';

  const flushBuf = () => {
    if (buf.length) {
      if (isDangerousSegment(buf)) {
        throw new Error(`Prototype pollution attempt detected in key: ${key}`);
      }

      out.push(buf);
      buf = '';
    }
  };

  while (i < n) {
    // disable linting rule for performance.
    /* eslint-disable-next-line unicorn/prefer-code-point */
    const ch = key.charCodeAt(i);
    if (ch === 46 /* '.' */) {
      flushBuf();
      i++;
      continue;
    }

    if (ch === 91 /* '[' */) {

View on GitHub (pinned to 7e1deec499)

Solutions

1. Do not use __proto__, constructor, or prototype as keys in dotted attribute paths; validate/sanitize user input used to build keys.

Example fix

const safe = key.replace(/(^|\.)(__proto__|constructor|prototype)(\.|$)/g, '_');

When it happens

Trigger: A key passed to undot contains a prototype-polluting segment such as __proto__.

Common situations: Unsanitized user input used as attribute paths.

AI-assisted analysis of sequelize/sequelize@7e1deec499 (2026-08-03). Data as JSON: /data/errors/e46aaff171592b91.json. Report an issue: GitHub.