Prototype Pollution in viking04/merge

Vulnerability

The @viking04/merge npm package (all versions prior to the fix) is vulnerable to Prototype Pollution. The merge function iterates over source object keys and assigns them to the destination without filtering dangerous keys like __proto__ or constructor. This allows an attacker to inject properties into the global Object.prototype by providing a source with a key such as __proto__ containing malicious payloads. The fix was committed in commit baba403 [1][2].

Exploitation

An attacker needs only the ability to supply a crafted object as a source argument to the merge function. No authentication or special privileges are required if the attacker controls the input data (e.g., via user-submitted JSON). A proof-of-concept is shown in the fix commit where JSON.parse('{"__proto__":{"polluted":true}}') is merged, causing {}.polluted to return true [2].

Impact

Successful exploitation allows the attacker to pollute the prototype chain of all objects, potentially leading to property injection, unexpected behavior in the application, and in some cases, remote code execution if polluted properties affect security-sensitive logic. The CVSS score is not provided in the references, but the severity is high due to potential for widespread impact [1].

Mitigation

The fix is available in commit baba403 [1][2]. Users should update to a version of @viking04/merge that includes this commit or later. As a workaround, applications can sanitize input objects manually to exclude __proto__ and constructor keys before passing them to merge. There is no indication that the package is listed on CISA KEV at the time of writing [1][2][3].