Wjm3

**Name of the Vulnerable Software and Affected Versions** TanStack devtools-vite version 0.7.0 **Description** An OS command injection issue exists within the Development Devtools Event Bus component. The problem occurs in the `installPackage()` function located in the `packages/devtools-bundler-core/src/package-manager.ts` file. Manipulation of the `packageName` argument allows for the execution of arbitrary operating system commands. This attack requires local access and is characterized by high complexity and difficult exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `installPackage()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** jQWidgets versions prior to 24.0.2 **Description** A remote attack can cause improperly controlled modification of object prototype attributes, a condition known as prototype pollution. This issue occurs within the `JQXLite.extend`/`jqxBaseFramework.extend` functions located in the `jqwidgets/jqx-all.js` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `JQXLite.extend`/`jqxBaseFramework.extend` functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** rexrainbow phaser3-rex-notes versions prior to 1.80.18 **Description** A remote attack is possible through the BehaviorTree Blackboard Data Interface component. Specifically, the `SetValue()` function within the `plugins/utils/object/SetValue.js` file is susceptible to prototype pollution, where manipulation of the `key` argument allows for the improperly controlled modification of object prototype attributes. **Recommendations** Update rexrainbow phaser3-rex-notes to version 1.80.18 or later. As a temporary mitigation, restrict the use of the `SetValue()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** alibaba-fusion next versions prior to 1.27.35 **Description** A prototype pollution flaw exists in the `deepMerge` component within the `components/dialog/index.tsx` file. This occurs when the `ConfigProvider.getContextProps()` function improperly handles the `locale` argument, allowing a remote attacker to modify object prototype attributes. **Recommendations** Update alibaba-fusion next to version 1.27.35 or later. As a temporary mitigation, restrict or validate the input passed to the `locale` argument in the `ConfigProvider.getContextProps()` function.

**Name of the Vulnerable Software and Affected Versions** ractivejs ractive versions prior to 1.4.5 **Description** A weakness exists in the Keypath Handler component where the `Ractive#set()` function allows improperly controlled modification of object prototype attributes, a condition known as prototype pollution. This issue can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.