CVE-2020-28282: Prototype pollution in getobject

The vulnerability stems from the set() function's handling of property paths. The function uses getParts() to split user-supplied paths and recursively traverses/creates objects. When a path contains special keywords like 'proto', it modifies the prototype chain instead of the target object. The PoC demonstrates this by polluting Object.prototype.isAdmin. The code at line 48 (obj[prop] = value) directly assigns values to the resolved property, including prototype properties. The get() function's 'create: true' parameter enables path traversal but the critical unsafe assignment occurs in set().