Returned-object prototype change via special-key assignment

Prototype poisoning in Ramda 0.27.0 and earlier allows remote attackers to alter application behavior through a crafted input object. mapObjIndexed copies each own input key into a plain accumulator with an acc[key] assignment, so an own proto key changes the returned object's prototype instead of creating an ordinary data property. Reachability depends on an application passing attacker-controlled objects to this function; Ramda disputes the security impact because the behavior creates a custom prototype only on the returned object.