Description
The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Remediation
References
https://hackerone.com/reports/310706
Related Vulnerabilities
CVE-2020-19850 Vulnerability in npm package directus
CVE-2023-1436 Vulnerability in maven package org.codehaus.jettison:jettison
CVE-2022-0401 Vulnerability in npm package w-zip
CVE-2019-16728 Vulnerability in maven package org.webjars.bowergithub.cure53:dompurify
CVE-2022-34113 Vulnerability in maven package io.dataease:dataease-plugin-common