CVE-2019-5428: Duplicate Advisory: Prototype Pollution in jquery

The vulnerability stems from jQuery's extend method when performing deep merges (first parameter true). The jQuery 3.4.0 release notes explicitly state they 'prevent Object.prototype pollution for $.extend(true, ...)' by blocking proto property copying. This matches the CVE description of prototype pollution via extend(). The function signature jQuery.extend matches runtime profiling patterns as it's a core jQuery API method. The evidence comes directly from the official patch notes describing the security fix in this specific function.