Launchpad.net

CVE 2021-3645

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

See the CVE page on Mitre.org for more details.