prototype pollution in unsafe merge function to react + markdown xss

Original writeup (https://cor.team/posts/redpwnCTF%202021%20-%20web%20challenges#mdbin).