From 990e97078f90237ea22272966190ffe014fd41a8 Mon Sep 17 00:00:00 2001
From: dreamwasp <cass.spain@skillsoft.com>
Date: Wed, 23 Sep 2026 12:41:02 -0400
Subject: [PATCH] fix(deepmerge): patch prototype pollution CVE-2026-93753

deepmerge@4.3.1 (transitive via react-player, used in the Video
component) has no upstream fix for a prototype pollution vuln. Patch
mergeObject's unsafe-key check to reject __proto__/constructor/prototype
keys, and pin all in-tree deepmerge ranges to the patched build via
yarn resolutions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../deepmerge-npm-4.3.1-4f751a0844.patch      | 19 +++++++++++++++++++
 package.json                                  |  3 +++
 yarn.lock                                     |  9 ++++++++-
 3 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 .yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch

diff --git a/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch b/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch
new file mode 100644
index 0000000000..b5806ea8af
--- /dev/null
+++ b/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch
@@ -0,0 +1,19 @@
+diff --git a/dist/cjs.js b/dist/cjs.js
+index 7c36cbdd06cc22c92d590be3f87a08a91ca06b40..a5bcd4c2e916e9791174bebda8658852688f59db 100644
+--- a/dist/cjs.js
++++ b/dist/cjs.js
+@@ -69,8 +69,14 @@ function propertyIsOnObject(object, property) {
+ 	}
+ }
+ 
++// Keys that can be used to reach up the prototype chain and pollute Object.prototype (CVE-2026-93753).
++var UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
++
+ // Protects from prototype poisoning and unexpected merging up the prototype chain.
+ function propertyIsUnsafe(target, key) {
++	if (UNSAFE_KEYS.indexOf(key) !== -1) {
++		return true
++	}
+ 	return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
+ 		&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
+ 			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
diff --git a/package.json b/package.json
index ebed4bad7d..3358aa3063 100644
--- a/package.json
+++ b/package.json
@@ -117,6 +117,9 @@
     "@types/react-test-renderer": "^18.2.0",
     "@typescript-eslint/utils": "^8.57.0",
     "axios": "1.14.0",
+    "deepmerge@npm:^4.0.0": "patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch",
+    "deepmerge@npm:^4.2.2": "patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch",
+    "deepmerge@npm:^4.3.1": "patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch",
     "error-ex": "1.3.4",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
diff --git a/yarn.lock b/yarn.lock
index 97acae82ee..34505a6fdc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10990,13 +10990,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"deepmerge@npm:^4.0.0, deepmerge@npm:^4.2.2, deepmerge@npm:^4.3.1":
+"deepmerge@npm:4.3.1":
   version: 4.3.1
   resolution: "deepmerge@npm:4.3.1"
   checksum: 10c0/e53481aaf1aa2c4082b5342be6b6d8ad9dfe387bc92ce197a66dea08bd4265904a087e75e464f14d1347cf2ac8afe1e4c16b266e0561cc5df29382d3c5f80044
   languageName: node
   linkType: hard
 
+"deepmerge@patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch":
+  version: 4.3.1
+  resolution: "deepmerge@patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch::version=4.3.1&hash=488791"
+  checksum: 10c0/5863a8d426429f5c7a080d6fb5ba003c6bbe6945efe86fcc90f0f9dd4aa69eaf87d84daf853239c5bf88453cbdc8855152406e153bdec234f34d4d3f10c0ab0a
+  languageName: node
+  linkType: hard
+
 "default-browser-id@npm:^5.0.0":
   version: 5.0.0
   resolution: "default-browser-id@npm:5.0.0"