What does $.extend() do, and what is the prototype pollution risk?

Summary

$.extend(target, ...sources) copies properties from source objects into the target (a shallow merge); $.extend(true, target, ...sources) merges deeply. A deep merge of untrusted input in older jQuery versions could set properties on Object.prototype through a __proto__ key (CVE-2019-11358, fixed in jQuery 3.4.0), polluting every object in the page.

Longer Answer

Prototype pollution can bypass checks (if (user.isAdmin) becomes true for every object) or enable XSS through gadgets in other libraries. Keep jQuery up to date, never deep-merge untrusted JSON into configuration objects, and for copying data prefer structuredClone or the spread operator ({ ...defaults, ...options }) for shallow merges.

Key Points

• Shallow by default; true = deep.
• Deep merging untrusted input polluted prototypes (fixed in 3.4.0).
• Update jQuery; avoid merging untrusted data.
• Spread/structuredClone in modern code.