Authenticated code execution via prototype-key view registration

Prototype pollution in Frappe.js 0.0.11 allows remote authenticated users to execute arbitrary code or interrupt service through crafted view names. The registerView function uses an attacker-controlled first argument as a property key and writes the supplied view beneath it, so proto redirects the write into Object.prototype. Reaching the flaw requires a consuming application to pass attacker-controlled arguments to registerView; code execution depends on an application gadget, and the denial-of-service failure mode is undisclosed.