Description
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Remediation
References
Related Vulnerabilities
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2022-23181)
Magento CVE-2019-7895 Vulnerability (CVE-2019-7895)
WordPress 3.0.1 Multiple Vulnerabilities (0.6.2 - 3.0.1)
b2evolution Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2013-7352)
WordPress Plugin Images Lazyload and Slideshow Cross-Site Scripting (3.2)