Prototype pollution in deep merge helpers

A crafted key path passed to the deep-merge helpers writes onto Object.prototype. Any code that later reads an unguarded property from a plain object can be steered by an attacker who controls one merge input.

SyntheticThis advisory is invented for the demonstration. lodash is a real package; nothing described here has been reported against it.