# CVE-2019-10768: Google Angular prototype pollution in merge function

Source: https://junglewise.ai/threats/cve-2019-10768-google-angular-prototype-pollution-in-merge-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-11-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-10768 · Severity: low · CVSS 3.1 · Published 2019-11-20

Angular is a JavaScript framework used to build interactive web applications. Versions before 1.7.9 contain a flaw in the deprecated merge() function that allows an attacker to inject malicious properties into the core Object prototype, potentially affecting all objects in an application and leading to data manipulation or application logic bypass.

Technologies: [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-10768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-10768 being exploited in the wild.

**How severe is CVE-2019-10768?** Low severity, with a CVSS score of 3.1, published 20 November 2019.

**Which products and versions are affected?** angular (npm) SEMVER:introduced=0,fixed=1.7.9.

**Is there a fix for CVE-2019-10768?** Yes. angular (npm): upgrade to 1.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-10768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-10768?** Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- angular (npm): upgrade to 1.7.9 or later

  ```sh
  npm install angular@1.7.9
  ```


## Technical details

The vulnerability is a prototype pollution flaw in the angular.merge() function (CWE-1321, CWE-20, CWE-915). The deprecated merge() API does not properly restrict modification of an Object's __proto__ property during deep merging operations, allowing an attacker to pollute the Object prototype with arbitrary properties. This is a network-reachable vulnerability requiring no authentication or user interaction; an attacker can craft malicious input containing __proto__ keys to inject properties that persist across all objects. The fix (version 1.7.9) explicitly blocks __proto__ from being merged, and this was already deprecated code so upgrades should not break existing functionality.

## Affected products

- Google Angular before 1.7.9

## Identifiers

- CVE-2019-10768
- GHSA-89mq-4x47-5v83

## Timeline

- 2019-11-20: disclosed: Advisory published
- 2019-11-07: patched: Fix merged in PR #16913

## References

- [https://github.com/angular/angular.js/pull/16913](https://github.com/angular/angular.js/pull/16913)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS srcset attribute sanitization bypass](https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)