The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.0171·Published 2022-05-01·Fixed in 3.2.2, 4.0.0-alpha.3CWE-1321