diff --git a/addons/web/static/lib/jquery.ba-bbq/jquery.ba-bbq.js b/addons/web/static/lib/jquery.ba-bbq/jquery.ba-bbq.js
index 3a5995d2b6c..39f2892e932 100644
--- a/addons/web/static/lib/jquery.ba-bbq/jquery.ba-bbq.js
+++ b/addons/web/static/lib/jquery.ba-bbq/jquery.ba-bbq.js
@@ -468,6 +468,7 @@
       coerce_types = { 'true': !0, 'false': !1, 'null': null };
     
     // Iterate over all name=value pairs.
+    if (params.indexOf('__proto__') !== -1) { return obj; }
     $.each( params.replace( /\+/g, ' ' ).split( '&' ), function(j,v){
       var param = v.split( '=' ),
         key = decode( param[0] ),
diff --git a/addons/web/static/lib/jquery/jquery.js b/addons/web/static/lib/jquery/jquery.js
index 01b858f1bf7..0e6cacae756 100644
--- a/addons/web/static/lib/jquery/jquery.js
+++ b/addons/web/static/lib/jquery/jquery.js
@@ -262,7 +262,7 @@ jQuery.extend = jQuery.fn.extend = function() {
 				copy = options[ name ];
 
 				// Prevent never-ending loop
-				if ( target === copy ) {
+				if ( name === '__proto__' || target === copy ) {
 					continue;
 				}