Historical sample · source analysis only. No reproduction has been performed by this application.
Objects share more than you might think
JavaScript objects inherit properties through a prototype chain. Looking up a property can return a value from an ancestor, even when the object itself has no such property.
That is useful language behavior. It becomes a vulnerability when untrusted input can modify an ancestor that many unrelated objects share.
Merging is a trust boundary
Lodash's defaultsDeep function recursively fills in missing values. CVE-2019-10744 concerns prototype pollution through this recursive merge behavior in affected versions. An attacker-controlled structure could reach a constructor's prototype rather than remain inside the intended destination object.
The important distinction is own properties versus inherited properties. A merge operation must not allow externally supplied property paths to navigate into shared language structures.
Pollution is not automatically code execution
A polluted prototype can influence later application logic, but its consequences depend on how the application reads those properties. Showing a changed inherited property demonstrates pollution, not necessarily an authorization bypass or remote code execution.
A useful isolated test would compare fresh processes using a vulnerable and a fixed version, record whether an unrelated object acquires an unexpected inherited property, and terminate each process afterward. This example has not executed that test.
Mitigation
Upgrade affected dependencies and consult the upstream advisory for the appropriate fixed version. Validate untrusted structures and avoid treating inherited properties as trusted application settings. Inspect transitive copies of Lodash as well as your direct dependency.