CVE-2021-4245: npm package rfc6902 vulnerable to Prototype Pollution

The vulnerability stems from the token-processing loop in Pointer's implementation. The pre-patch code in pointer.ts iterated through path tokens and directly assigned values using value = (parent || {})[key] without checking for dangerous keys. The patch adds a guard clause to skip proto/constructor/prototype keys, confirming this was the injection point. The evaluate method (implied by the token traversal logic) is responsible for resolving JSON pointers, making it the logical location for this prototype pollution vulnerability.