AIKIDO-2026-965960

TL;DR

The mergeInto utility in @datadog/browser-core performs a recursive deep merge that assigns into finalDestination[key] without guarding against the __proto__ key. When the merged data originates from untrusted input, such as context passed to the SDK or JSON read from storage and remote configuration via tryJsonParse, the recursion walks into __proto__ and mutates the shared Object.prototype. This lets an attacker inject or override properties on the global object prototype, corrupting application behavior for all objects. The fix skips the __proto__ key during merges in mergeInto (and therefore combine and deepClone) and strips __proto__ from objects returned by tryJsonParse.