In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
merge()
Object.prototype
__proto__
{ "ubuntu_priority": "low" }
{ "binaries": [ { "binary_name": "libjs-angularjs", "binary_version": "1.7.9-1" } ], "availability": "No subscription required", "ubuntu_priority": "low" }