Timothee Desurmont

**Name of the Vulnerable Software and Affected Versions** mockjs versions prior to a version with the fixed Util.extend function **Description** The issue arises from a missing check in the Util.extend function, allowing Prototype Pollution. This occurs when an attribute resolves to the object prototype, enabling the addition or modification of attributes on an object prototype. As a result, attributes can be created that exist on every object, or critical attributes can be replaced with malicious ones. This is particularly problematic if the software relies on the existence or non-existence of certain attributes or uses pre-defined attributes of the object prototype, such as hasOwnProperty, toString, or valueOf. User-controlled inputs inside the extend() method of Mock.Handler, Mock.Random, Mock.RE.Handler, or Mock.Util can be exploited. **Recommendations** To resolve the issue, add a denylist of dangerous attributes to the Util.extend function. Specifically, add the line `if ([" proto ", "constructor", "prototype"].includes(name)) continue` to eliminate this weakness. This modification will prevent the exploitation of the Prototype Pollution vulnerability.

**Name of the Vulnerable Software and Affected Versions** eventsource/eventsource versions prior to 2.0.2 **Description** The issue is related to insufficient protection of sensitive data, allowing a remote attacker to gain unauthorized access to protected information. This is due to the improper removal of sensitive information before storage or transfer. When fetching a URL with a link to an external site, users' cookies and authorization headers are leaked to the third-party application, violating the same-origin-policy. **Recommendations** For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and sanitizing headers when redirecting to external sites to minimize the risk of exploitation.