Prototype Pollution

set-in is vulnerable to prototype pollution. An attacker is able to inject malicious property types via setIn method and merge object prototypes into it, resulting in prototype pollution vulnerability.