CVE-2021-44908: Prototype Pollution in Sails.js

The vulnerability stems from the loadActionModules() function's handling of dynamically loaded action files. The code uses unsanitized file paths to create action identities (line 163: actionsLoadedFromDisk[actionIdentity] = true). If an attacker controls the file path (e.g., via malicious file creation), they can set actionIdentity to a prototype property like __proto__.polluted, leading to prototype pollution. This matches the CWE-1321 pattern and is explicitly referenced in the advisory's code link to line 32 of load-action-modules.js (though the critical logic occurs later in the file). The GitHub issue #7209 confirms the else-if block (lines 134-165) contains the vulnerable assignment.