[anupamme]

Summary

Harden input handling in src/traverse/estraverse (flagged by multi_agent_ai).

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/traverse/estraverse:358
Assessment	Defensive hardening
Chain Complexity	2-step

Description: The traverse module uses Object.assign(Object.create(this.__keys), visitor.keys) to merge visitor-provided keys with default VisitorKeys. If an attacker controls the visitor.keys object and supplies properties named 'proto', 'constructor', or 'prototype', they could pollute the prototype chain affecting all objects in the application.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/traverse/estraverse

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[emilos]

thanks, can you add tests to prevent regressions?

[anupamme]

thanks, can you add tests to prevent regressions?

Done. Pls review.

[emilos]

Thanks for the report. I've pushed a commit on top rather than closing this, because the line you flagged was genuinely worth changing — just not for the reason the scanner gave.

On the finding itself: Object.prototype is never written to on any of these paths. In the original

this.__keys = Object.assign(Object.create(this.__keys), visitor.keys)

the assignment target is Object.create(VisitorKeys) — a throwaway object owned by one Controller. An own enumerable __proto__ on the source does reach the inherited __proto__ setter, but that setter reassigns that local object's prototype, not Object.prototype. constructor and prototype are not special here at all; they just become own properties.

Measured against the unpatched code, all three vectors leave Object.prototype clean:

vector	unpatched behaviour	Object.prototype polluted?
own enumerable __proto__	throws Unknown node type Program	no
constructor	completes normally	no
prototype	completes normally	no

Two of the three regression tests in this PR pass against the unpatched source, so they'd stay green even if the merge broke completely. The __proto__ one fails, but because traverse throws — replacing the prototype loses VisitorKeys — not because of pollution.

What was actually worth fixing: assignment is the only reason __proto__ was ever special, so the fix is to stop assigning rather than to enumerate names. Object spread defines each key instead:

this.__keys = visitor.keys ? { ...VisitorKeys, ...visitor.keys } : VisitorKeys

This also drops the denylist, which had two problems: it silently discards a legitimate key named constructor or prototype, and because it still uses =, it stops working if Object.prototype has already been polluted with an accessor or a read-only property (this file has no "use strict", so that failure is silent). The prototype chain goes too — nothing read the keys that way; both call sites are a plain this.__keys[nodeType] lookup.

I replaced the three pollution tests with five that cover behaviour: custom keys are visited, defaults still apply to unmentioned types, overrides win, __proto__ no longer destroys the defaults (the one real regression), and a key named constructor survives. Your two behavioural tests are effectively preserved in that set.

Full suite passes, and your original tests also pass against this version.

One request for the tooling: CRITICAL for a pattern match on Object.assign + __proto__ without tracing the assignment target isn't a severity anyone can act on. The underlying observation — that this line was doing something subtle and unexplained — was a good one, and it's what I've fixed.

[emilos]

@anupamme thanks, I've reviewed and updated the code to be more aligned w/ the current behavior. Have a nice day!