From 45e66f123e9dea029c2362d3c9999947b8e79d7e Mon Sep 17 00:00:00 2001
From: Benjie Gillam <benjie@jemjie.com>
Date: Tue, 24 Mar 2026 15:54:33 +0000
Subject: [PATCH 1/2] Use Object.create(null) over {} to avoid prototype issues

---
 src/execution/values.ts           | 4 ++--
 src/utilities/coerceInputValue.ts | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/execution/values.ts b/src/execution/values.ts
index 5b2a1ceee2..06937b080d 100644
--- a/src/execution/values.ts
+++ b/src/execution/values.ts
@@ -206,7 +206,7 @@ export function getArgumentValues(
   fragmentVariableValues?: Maybe<FragmentVariableValues>,
   hideSuggestions?: Maybe<boolean>,
 ): { [argument: string]: unknown } {
-  const coercedValues: { [argument: string]: unknown } = {};
+  const coercedValues: { [argument: string]: unknown } = Object.create(null);
 
   const argumentNodes = node.arguments ?? [];
   const argNodeMap = new Map(argumentNodes.map((arg) => [arg.name.value, arg]));
@@ -224,7 +224,7 @@ export function getArgumentValues(
       hideSuggestions,
     );
   }
-  return coercedValues;
+  return { ...coercedValues };
 }
 
 // eslint-disable-next-line max-params
diff --git a/src/utilities/coerceInputValue.ts b/src/utilities/coerceInputValue.ts
index 87895c2262..aa2df09e57 100644
--- a/src/utilities/coerceInputValue.ts
+++ b/src/utilities/coerceInputValue.ts
@@ -69,7 +69,7 @@ export function coerceInputValue(
       return; // Invalid: intentionally return no value.
     }
 
-    const coercedValue: any = {};
+    const coercedValue: any = Object.create(null);
     const fieldDefs = type.getFields();
     const hasUndefinedField = Object.keys(inputValue).some(
       (name) => !Object.hasOwn(fieldDefs, name),
@@ -109,7 +109,7 @@ export function coerceInputValue(
       }
     }
 
-    return coercedValue;
+    return { ...coercedValue };
   }
 
   const leafType = assertLeafType(type);

From 3ee6c94f34c701472b33c9d405dd1a620f081b2c Mon Sep 17 00:00:00 2001
From: Yaacov Rydzinski <yaacovCR@gmail.com>
Date: Thu, 16 Apr 2026 13:27:00 +0300
Subject: [PATCH 2/2] remove prototype from `args` map, coerced input
 values/literals

---
 src/execution/values.ts           | 6 +++---
 src/utilities/coerceInputValue.ts | 7 ++++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/execution/values.ts b/src/execution/values.ts
index 06937b080d..623060203b 100644
--- a/src/execution/values.ts
+++ b/src/execution/values.ts
@@ -205,8 +205,8 @@ export function getArgumentValues(
   variableValues?: Maybe<VariableValues>,
   fragmentVariableValues?: Maybe<FragmentVariableValues>,
   hideSuggestions?: Maybe<boolean>,
-): { [argument: string]: unknown } {
-  const coercedValues: { [argument: string]: unknown } = Object.create(null);
+): ObjMap<unknown> {
+  const coercedValues: ObjMap<unknown> = Object.create(null);
 
   const argumentNodes = node.arguments ?? [];
   const argNodeMap = new Map(argumentNodes.map((arg) => [arg.name.value, arg]));
@@ -224,7 +224,7 @@ export function getArgumentValues(
       hideSuggestions,
     );
   }
-  return { ...coercedValues };
+  return coercedValues;
 }
 
 // eslint-disable-next-line max-params
diff --git a/src/utilities/coerceInputValue.ts b/src/utilities/coerceInputValue.ts
index aa2df09e57..7be15ef677 100644
--- a/src/utilities/coerceInputValue.ts
+++ b/src/utilities/coerceInputValue.ts
@@ -2,6 +2,7 @@ import { invariant } from '../jsutils/invariant.js';
 import { isIterableObject } from '../jsutils/isIterableObject.js';
 import { isObjectLike } from '../jsutils/isObjectLike.js';
 import type { Maybe } from '../jsutils/Maybe.js';
+import type { ObjMap } from '../jsutils/ObjMap.js';
 
 import type { ValueNode, VariableNode } from '../language/ast.js';
 import { Kind } from '../language/kinds.js';
@@ -69,7 +70,7 @@ export function coerceInputValue(
       return; // Invalid: intentionally return no value.
     }
 
-    const coercedValue: any = Object.create(null);
+    const coercedValue: ObjMap<unknown> = Object.create(null);
     const fieldDefs = type.getFields();
     const hasUndefinedField = Object.keys(inputValue).some(
       (name) => !Object.hasOwn(fieldDefs, name),
@@ -109,7 +110,7 @@ export function coerceInputValue(
       }
     }
 
-    return { ...coercedValue };
+    return coercedValue;
   }
 
   const leafType = assertLeafType(type);
@@ -211,7 +212,7 @@ export function coerceInputLiteral(
       return; // Invalid: intentionally return no value.
     }
 
-    const coercedValue: { [field: string]: unknown } = {};
+    const coercedValue: ObjMap<unknown> = Object.create(null);
     const fieldDefs = type.getFields();
     const hasUndefinedField = valueNode.fields.some(
       (field) => !Object.hasOwn(fieldDefs, field.name.value),