Code execution via unsafe prototype path write

Prototype pollution in cdr0 @cdr0/sg 1.0.10 and earlier allows remote attackers to execute arbitrary code via crafted property paths. The setOn function in ref.js follows attacker-controlled dot-separated paths and writes through proto or constructor.prototype, modifying Object.prototype without blocking special keys. Exploitation requires a consuming application to pass an attacker-controlled path to setOn; the demonstrated primitive changes inherited properties, while code execution depends on application logic that uses the polluted values.