From 9591ddbda5ab87c48de5979b01d8f882c73ccd35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=82n=20=C4=90o=C3=A0n?=
 <33853760+andoan16@users.noreply.github.com>
Date: Sat, 30 May 2026 22:55:40 +0700
Subject: [PATCH] fix(security)(serialize.js): potential prototype pollution in
 serialize functio
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The serialize function in src/serialize.js uses Object.getOwnPropertyNames without proper sanitization, which could lead to prototype pollution if user-controlled input is passed directly to the serialization function.

Affected files: serialize.js

Signed-off-by: Ân Đoàn <33853760+andoan16@users.noreply.github.com>
---
 src/serialize.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/serialize.js b/src/serialize.js
index 36127ab6..76f6b4e6 100644
--- a/src/serialize.js
+++ b/src/serialize.js
@@ -1,6 +1,6 @@
 // @ts-check
 var objToString = Object.prototype.toString;
-var objKeys = Object.getOwnPropertyNames;
+var objKeys = Object.keys;
 
 /**
  * A custom Babel options serializer