Name of the Vulnerable Software and Affected Versions mithril versions prior to 1.1.7 mithril versions prior to 2.0.2

Description The issue allows a malicious user to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. This can be achieved by using a payload such as proto [toString]=123 in the query string, which would change the toString() function to 123. The function parseQueryString is involved in this issue.

Recommendations If you are using mithril 1.x, upgrade to version 1.1.7 or later. If you are using mithril 2.x, upgrade to version 2.0.2 or later.