babel-helper-vue-jsx-merge-props

hi, we are a security team. We found a prototype pollution vulnerability in your project. 1. Vulnerability Type & Cause Vulnerability Type: Prototype Pollution Root Cause: The mergeJSXProps function uses for...in loops without hasOwnProperty checks to iterate user‑controlled objects, and performs unsafe dynamic property assignment. Attackers can inject the __proto__ key to modify the object prototype, leading to local prototype pollution. 2. Vulnerability Location Affected Package: babel‑helper‑vue‑jsx‑merge‑props@2.0.3 Vulnerable File: index.js Key Vulnerable Lines: Line 6: Line 25: Line 34: Line 38: 3. Proof of Concept (PoC) 4. PoC Expected Output 5. Fixed Code 6.Fix Verification Fixed Output

This project is missing a LICENSE or COPYING file containing a copy of MIT license. https://github.com/babel/babel/pull/7308#issuecomment-367615152

I am using with and encountered a problem somewhat like This directive makes v-show not work when been added after it After reading the codes I found that is using to merge props but nest merge of 'directives' is not supported, that is what causes the problem. Owing to my limited knowledge, I cannot see why. Please consider it if it's reasonable.