Language: JavaScript
Label: safe
CWE: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Code:
  Dottie.set = function(object, path, value, options) {
    var pieces = Array.isArray(path) ? path : path.split('.'), current = object, piece, length = pieces.length;
    if (pieces[0] === '__proto__') return;

    if (typeof current !== 'object') {
        throw new Error('Parent is not an object.');
    }

    for (var index = 0; index < length; index++) {
      piece = pieces[index];

      // Create namespace (object) where none exists.
      // If `force === true`, bruteforce the path without throwing errors.
      if (
        !hasOwnProp.call(current, piece)
        || current[piece] === undefined
        || ((typeof current[piece] !== 'object' || current[piece] === null) && options && options.force === true)) {
        current[piece] = {};
      }

      if (index == (length - 1)) {
        // Set final value
        current[piece] = value;
      } else {
        // We do not overwrite existing path pieces by default
        if (typeof current[piece] !== 'object' || current[piece] === null) {
          throw new Error('Target key "' + piece + '" is not suitable for a nested value. (It is in use as non-object. Set `force` to `true` to override.)');
        }

        // Traverse next in path
        current = current[piece];
      }
    }

    // Is there any case when this is relevant? It's also the last line in the above for-loop
    current[piece] = value;
  };