function isValidKey(key) {
  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.