Object prototype modification via array-valued path keys

Prototype pollution in Luke Edwards dset before 3.1.4 allows remote attackers to modify Object.prototype via crafted path arrays. The dset and dset/merge functions compare each path key with blocked names before coercing it to a string, so an array-valued key such as ['proto'] bypasses the check and selects Object.prototype. Exploitation requires a consuming application to pass attacker-controlled path components; polluted properties can alter application behavior or interrupt the service.