Description
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
Remediation
References
https://snyk.io/vuln/SNYK-JS-UTILITIFY-559497
https://github.com/xcritical-software/utilitify/commit/88d6e27009823338bf319ffb768fe6b08e8ad2d1%2C
Related Vulnerabilities
CVE-2021-23438 Vulnerability in npm package mpath
CVE-2022-36911 Vulnerability in maven package org.jenkins-ci.plugins:openstack-heat
CVE-2021-32860 Vulnerability in maven package org.webjars.npm:izimodal
CVE-2021-37694 Vulnerability in npm package @asyncapi/java-spring-cloud-stream-template
CVE-2011-4905 Vulnerability in maven package activemq:activemq