Prototype pollution via nested __proto__ assignment

Prototype pollution in RDF-Ext rdf-graph-array 0.3.0-rc6 and earlier allows remote attackers to modify object behavior via crafted graph data. The rdf.Graph.prototype.add method uses attacker-controlled graph, subject, predicate, and object strings as ordinary nested object keys, so a proto key redirects later assignments into Object.prototype. Exploitation requires an application to pass attacker-controlled RDF quad values to add; the demonstrated result changes inherited properties across objects in that process.