deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/…

The deepobj JavaScript library, which provides functionality to get, set, and delete deep objects, contains a prototype pollution vulnerability prior to version 1.0.3. The vulnerability occurs when property paths contain __proto__/constructor/prototype elements. Exploitation requires that property paths are exposed as user input. The issue has been resolved in version 1.0.3 of the library.