The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-1321,
Products Affected