Description
HI! I would very thankful if you upgrade json-merge-patch from 0.2.3 to 1.0.2 in ajv-merge-patch 4.1.0 version.
json-merge-patch has vulnerability and i haven’t ability upgrade ajv-merge-patch to 5.0.1 version.
Explanation
The json-merge-patch package is vulnerable to Prototype Pollution. The apply function in the apply.js file allows the addition or modification of object prototype properties via accessors such as proto or constructor.prototype. A remote attacker with the ability to apply patches or influence their content can exploit this vulnerability to modify the behavior of object prototypes which, depending on their use in the application, may result in a Denial of Service (DoS), Remote Code Execution (RCE), or other unexpected behavior.