Object prototype pollution via recursive merge

Prototype pollution in MooTools Core 1.5.2 and earlier allows remote attackers to alter inherited object properties via crafted input. Object.merge recursively follows a crafted proto property into Object.prototype and copies attacker-controlled properties onto it. Exploitation requires a consuming application to pass attacker-controlled objects to Object.merge, and downstream impact depends on its use of polluted properties.