In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
merge()
Object.prototype
__proto__
{ "ubuntu_priority": "low" }
{ "binaries": [ { "binary_version": "1.7.9-1", "binary_name": "libjs-angularjs" } ], "ubuntu_priority": "low", "availability": "No subscription required" }