Object prototype modification via inherited property traversal

Prototype pollution in Dexie.js before 3.2.2 and 4.0.0-alpha.1 through 4.0.0-alpha.2 allows attackers to modify Object.prototype. The setByKeyPath function follows attacker-controlled key-path segments and, before the patch, reuses an inherited object because it checks only whether the lookup is truthy rather than whether the property belongs to the target object. Applications become exposed when they pass untrusted keys into collection modification or another reachable setByKeyPath call, allowing poisoned prototype properties to affect later application logic.