AIKIDO-2025-10176

TL;DR

Affected versions of this package are vulnerable to prototype pollution, allowing an attacker to inject properties such as isAdmin into an object's prototype when merging an object containing a __proto__ property using the mergeRecursively function of the merge-anything library. This can lead to unauthorized access, privilege escalation, and unpredictable application behavior due to bypassed permission checks. To mitigate this issue, applications should explicitly filter out keys like __proto__, prototype, and constructor. Given the library's widespread usage, multiple use cases may be affected by this vulnerability.