AIKIDO-2026-438647

TL;DR

The deepMerge utility in @instana/core (packages/core/src/util/deepMerge.js) recursively merges source objects into a target without filtering dangerous property keys. When a source object contains keys such as __proto__, constructor, or prototype (for example from JSON.parse of attacker-influenced input), the recursive merge writes onto Object.prototype, polluting every object in the runtime. This can enable application logic manipulation, property injection, and potential escalation depending on the consuming application. The fix updates deepMerge to skip these unsafe keys during the merge.