CVE-2025-25977: Js Prototype Pollution Bracket Fallback Then Writecve-2025-25977-js-prototype-pollution-bracket-fallback-then-write
Reading a property from a plain object with a non-literal key and a `|| {}` fallback, then writing into the resulting object via bracket notation, enables prototype pollution (CWE-1321; see CVE-2025-25977). If the key evaluates to "__proto__", the lookup resolves to Object.prototype (not undefined), and the subsequent `props[name] = value` writes onto the gl
