CVE-2019-18954: Pomelo allows external control of critical state data

The vulnerability stems from the Handler constructor directly assigning user-provided 'app' parameter to instance properties. The PoC demonstrates sending {get:{}} in requests to connector.entryHandler.constructor endpoint, which overwrites the get method. The lack of input validation/sanitization in the constructor allows property collision attacks. Runtime detection would show the Handler constructor processing malicious input when attackers attempt to overwrite internal attributes.