Prototype Pollution in underscore.deep

An attacker can exploit this vulnerability by providing a specially crafted payload to the `deepFromFlat` function. This payload would include keys such as `__proto__.polluted1` or `constructor.prototype.polluted2`. When processed, these keys can modify the `Object.prototype`, affecting all subsequent objects created in the application. This vulnerability is also present in `deepPick` due to its reliance on `deepFromFlat` [ref_id=1].

The vulnerability resides in the `deepFromFlat` function within the `underscore.deep` library. Specifically, the issue occurs in the loop that processes the `parts` array, where keys are used to traverse and build the nested object structure. The patch adds a condition to skip processing parts that are `__proto__`, `constructor`, or `prototype` [ref_id=1].

The patch modifies the `deepFromFlat` function to include a check for specific keywords within the `parts` array. If a part is found to be `__proto__`, `constructor`, or `prototype`, the loop continues to the next iteration, effectively skipping these potentially malicious keys. This prevents the modification of the global `Object.prototype` and mitigates the prototype pollution vulnerability [ref_id=1].