Kevgeoleo

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. A prototype pollution issue exists in the `shared/utils.mjs` file, specifically at line 94, where the `indexOf()` function is used to validate user-provided input. Despite a prior attempt to address prototype pollution by checking for forbidden keys, it remains possible to pollute `Object.prototype` using a crafted input leveraging `Array.prototype`. This issue impacts Windows and Linux systems, as well as Node and Bun runtimes. Applications processing attacker-controlled input with this package may be susceptible to Authentication Bypass, Denial of Service, and Remote Code Execution (RCE).

set-in is a Node.js package that sets values within nested associative structures given an array of keys. A flaw exists where, despite a previous attempt to prevent prototype pollution by checking for forbidden keys, it remains possible to pollute `Object.prototype` using a crafted input leveraging `Array.prototype`. The issue resides in the `includes()` function used to validate user input. A proof-of-concept demonstrates bypassing the intended protection by redefining `Array.prototype.includes` to always return false, allowing the injection of a property named `polluted` into `Object.prototype`. This could potentially lead to authentication bypass, denial of service, or remote code execution if the polluted property is passed to vulnerable sinks.

Locutus, designed to bring standard libraries from other programming languages to JavaScript for educational purposes, contains a prototype pollution issue. A previous attempt to address prototype pollution by checking for forbidden keys in user input was insufficient. It remains possible to pollute `Object.prototype` through a crafted input utilizing `String.prototype`. This allows for malicious property injection, potentially leading to further compromise.

A prototype pollution issue exists in the deephas npm package. This allows an attacker to modify global object behavior by injecting properties into Object.prototype. The issue resides in the `add()` function and `indexer()` function within `deepHas.js`. The vulnerability can be bypassed by manipulating `Object.prototype.hasOwnProperty` or `String.prototype.indexOf`. Exploitation can lead to authentication bypass, denial of service, and potentially remote code execution if polluted properties are passed to vulnerable sinks.