Description
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
Remediation
References
Related Vulnerabilities
WordPress Plugin Google Map Remote Code Execution (1.0)
WordPress Plugin Formidable-Clockwork SMS Cross-Site Scripting (1.0.3)
Adobe Coldfusion 8 multiple linked XSS vulnerabilies
WordPress Plugin WooCommerce Cross-Site Request Forgery (3.6.4)
Jenkins Deserialization of Untrusted Data Vulnerability (CVE-2018-1999042)