@theecryptochad/merge-guard versions prior to 1.0.1 contain a Prototype Pollution vulnerability in the deepMerge() function. This occurs because the function merges objects without filtering out special keys like __proto__, allowing an attacker to modify Object.prototype. This can lead to privilege escalation and application logic bypass when untrusted input is merged.