From 72c742534141f3d80a364a93e8cc3fda684ad094 Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 18 Sep 2026 14:41:31 +0000 Subject: [PATCH] fix: multi_agent.cwe-1321 security vulnerability Automated security fix generated by OrbisAI Security Signed-off-by: anupamme --- .../ruleset/src/utils/merge-allof-schema-properties.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/ruleset/src/utils/merge-allof-schema-properties.js b/packages/ruleset/src/utils/merge-allof-schema-properties.js index dd18b7b1..220ee6ae 100644 --- a/packages/ruleset/src/utils/merge-allof-schema-properties.js +++ b/packages/ruleset/src/utils/merge-allof-schema-properties.js @@ -61,7 +61,12 @@ function mergeAllOfSchemaProperties(schema) { * @param {*} sourceValue a field from the merge source * @returns the "merged" value */ -function customizer(targetValue, sourceValue) { +function customizer(targetValue, sourceValue, key) { + // Prevent prototype pollution by refusing to merge dangerous keys. + if (key === '__proto__' || key === 'constructor' || key === 'prototype') { + return targetValue; + } + // Allow non-object fields from the merge source to be overwritten in the target. if (!isObject(sourceValue)) { return sourceValue;