__proto__ vulnerability

[KSXGitHub]

const { load, safeLoad } = require('js-yaml')
const yamlText = '__proto__: { evil: true }'
const a = load(yamlText)
const b = safeLoad(yamlText)
console.log(a.evil, b.evil)

Expect: undefined undefined
Received: true true

If I use js-yaml to process user's input, it would allow malicious users to inject object prototype into my server.

[puzrin]

1. This dupes Object properties should be created using defineProperty #164.
2. This is NOT vulnerability, because does not affects other objects.