@Nana7mi0721/anima-style-lora-workflow-bundle

READ_ONLY_KEYS only blocks the top-level key 'home'. A POST body like {"set":{"__proto__.x":1}} flows through applyPatch -> setPath: for part '__proto__' the guard sees an object and does not replace it, so `node` becomes Object.prototype and the final assignment (or the intermediate one) writes onto the prototype of the whole DSH host process. Any request passing the trust fence (a no-Origin local process, or a same-hostname page using a simple text/plain POST, which needs no CORS preflight) can do this. Effect ranges from host-process denial of service to gadget-assisted code execution depen

The fence accepts a request whenever the Origin hostname equals the Host hostname, regardless of scheme or port, and accepts requests with no Origin at all. When the DSH web server is bound to 'localhost' (isLoopbackHostname returns true for it), a page served from http://localhost:<any other port> is 'same-site' (Sec-Fetch-Site is not 'cross-site') and passes the Origin hostname comparison, so it can POST to /anima-lora/api/read and receive the runtime layer of animasl.config.json containing danbooru_login/danbooru_api_key and the three exhentai cookies, and can POST text/plain JSON to /write

Any caller that passes the trust fence can enumerate up to 64 arbitrary absolute paths per request and learn which files/directories exist on the host. Combined with the fence weakness above, a same-hostname local page could map the user's filesystem. No file contents are returned and a local process already has equivalent access, so impact is limited to information disclosure.