Prototype Pollution

controlled-merge is vulnerable to prototype pollution. Lack of validation allows an attacker to inject arbitrary properties into __proto__ or constructor to crash the application and potentially obtain remote code execution.