In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
merge()
Object.prototype
__proto__
{ "urgency": "not yet assigned" }