Security: prototype pollution in set/setWith (audit-blind twin of radashi CVE-2025-48054); consider migrating users to radashi

[peaktwilight]

Heads-up (private vulnerability reporting isn't enabled on the repo, so raising it here as a constructive ecosystem-hygiene note).

radash's set/setWith are vulnerable to prototype pollution — the same defect that was fixed and disclosed in the maintained fork radashi as CVE-2025-48054 / GHSA-2xv9-ghh9-xc69, but never patched here. Because the advisory is filed under radashi, npm audit does not warn radash's users, so a large install base is silently exposed.

PoC (radash@12.1.0, latest):

const { set } = require("radash");
const o = {};
set(o, "__proto__.polluted", "yes");
console.log(({}).polluted); // -> "yes"  (Object.prototype polluted)

This is chainable to RCE via the Node NODE_OPTIONS gadget when a subprocess is spawned. Prototype pollution, CWE-1321.

Since radash appears unmaintained, the practical fix for users is to migrate to the maintained fork radashi (which patched this), or to guard __proto__/constructor/prototype keys in set/setWith. Filing this so radash users have a public signal — no ask.

Reported by 0sec (https://0sec.ai).