CVE-2026-35209: Object Assign Prototype Hijackcve-2026-35209-object-assign-prototype-hijack
Cloning objects with `Object.assign({}, ...)` can lead to local prototype pollution if an input argument contains a malicious `__proto__` property (such as from parsed JSON). `Object.assign` invokes the `__proto__` setter on the new empty target object, altering its prototype chain. When this cloned object is subsequently merged, iterated via `for...in`, or
