Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of "underscore.deep" prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to "deepFromFlat", which would pollute any future Objects created. Any users that have "deepFromFlat" or "deepPick" (due to its dependency on "deepFromFlat") in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying "deepFromFlat" to prevent specific keywords which will prevent this from happening.