Object prototype modification via unsafe recursive merge

Prototype pollution in jesusgm Deepmergefn 1.1.0 and earlier allows remote attackers to modify Object.prototype via crafted input. deepMerge follows the inherited target property selected by a source proto key, then assigns attacker-controlled child properties to Object.prototype without blocking prototype-sensitive keys. Exploitation requires a consuming application to pass attacker-controlled objects to the library; resulting data changes, service interruption, or code execution require an application-specific gadget that reads a polluted property.