Wjm1

**Name of the Vulnerable Software and Affected Versions** RobinHerbots Inputmask versions prior to 5.0.10 **Description** An issue exists in the Internal Deep Merge Helper component within the `lib/dependencyLibs/extend.js` library. The functions `extendDefaults()`, `extendDefinitions()`, and `extendAliases()` allow for improperly controlled modification of object prototype attributes, which can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CartoDB carto-api-client version 0.5.29 **Description** A remote attack is possible through the manipulation of the `column` argument within the `addFilter()` function located in the src/filters.ts file. This leads to prototype pollution, which is the improper modification of object prototype attributes, potentially allowing an attacker to alter the behavior of the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `addFilter()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** sagold json-schema-library versions 11.5.0 through 11.5.1 **Description** A remote attack can lead to the improperly controlled modification of object prototype attributes. This issue occurs within the `parsePropertyDependencies()` function located in the `src/keywords/propertyDependencies.ts` file. **Recommendations** Update sagold json-schema-library to version 11.6.0.

**Name of the Vulnerable Software and Affected Versions** svgdotjs svg.js versions prior to 3.2.6 **Description** A remote attack can be initiated through the npm Package API component. The issue resides in the `EventTarget.on()` function within the `svgdotjs/svg.js` file, where improper manipulation allows for the uncontrolled modification of object prototype attributes. This is known as prototype pollution, a condition where an attacker can inject properties into existing JavaScript objects. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `EventTarget.on()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** tamagui versions prior to 2.3.1 **Description** A remote attack can lead to the improperly controlled modification of object prototype attributes, a condition known as prototype pollution. This issue occurs within the `updateConfig()` function located in the `code/core/web/src/config.ts` file. **Recommendations** Update to version 2.3.1.

**Name of the Vulnerable Software and Affected Versions** kofrasa mingo versions prior to 7.2.2 **Description** An issue exists in the Update API component where manipulating the `Set` argument within the `update()`, `updateOne()`, and `updateMany()` functions can lead to improperly controlled modification of object prototype attributes. This condition allows for a remote attack. **Recommendations** Upgrade to version 7.2.2.

**Name of the Vulnerable Software and Affected Versions** spencermountain compromise versions prior to 14.15.1 **Description** Remote exploitation is possible through the Public Root API component. The `nlp.extend()` function in the `src/API/extend.js` file allows for the improper modification of object prototype attributes when the `plugin` argument is manipulated. This issue is known as prototype pollution, where an attacker can inject properties into existing object prototypes, potentially altering the behavior of the application. **Recommendations** Apply the patch b4644ab7179700df0607521f61c1ee9b5f78d89d to versions prior to 14.15.1. As a temporary mitigation, restrict the use of the `nlp.extend()` function.