Yuhan Gao

**Name of the Vulnerable Software and Affected Versions** algoliasearch-helper versions 2.0.0-rc1 through 3.11.2 **Description** The package contains a Prototype Pollution issue in the ` merge()` function within the `merge.js` file. This allows modification of the `constructor.prototype`, potentially leading to code execution if errors are caught and user-supplied search parameters are injected. This is a distinct issue from another reported problem. The vulnerability is not exploitable in the default configuration of InstantSearch because search parameters are not user-modifiable. **Recommendations** Update to a version after 3.11.2.

**Name of the Vulnerable Software and Affected Versions** underscore-keypath versions 0.0.11 and later **Description** The issue arises from improper input sanitization in the `setProperty()` function, allowing the usage of arguments like ` proto ` and leading to Prototype Pollution. This can be exploited due to the lack of proper input validation. **Recommendations** For versions 0.0.11 and later, consider disabling the `setProperty()` function until a patch is available to prevent exploitation. Restrict the use of the `name` argument in the `setProperty()` function to minimize the risk of Prototype Pollution. Avoid using arguments like ` proto ` in the `setProperty()` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** flatnest versions all **Description** The issue concerns Prototype Pollution via the `nest()` function in the `flatnest/nest.js` file. This affects all versions of the package flatnest. **Recommendations** For all versions, consider disabling the `nest()` function as a temporary workaround until a patch is available. Restrict access to the `flatnest/nest.js` file to minimize the risk of exploitation. Avoid using the `nest()` function in sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** progressbar.js versions prior to 1.1.1 **Description** The issue concerns Prototype Pollution via the `extend()` function in the `utils.js` file. This affects the progressbar.js package. **Recommendations** For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the `extend()` function in the `utils.js` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dottie versions prior to 2.0.4 **Description** The issue is related to Prototype Pollution due to insufficient checks. It can be exploited via the `set()` function and the `current` variable in the `/dottie.js` file. **Recommendations** For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the `set()` function until a patch is available. Restrict access to the `/dottie.js` file to minimize the risk of exploitation. Avoid using the `current` variable in the affected function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** collection.js versions prior to 6.8.1 **Description** The issue concerns Prototype Pollution via the `extend` function in `Collection.js/dist/node/iterators/extend.js`. This affects versions of the package collection.js before 6.8.1. **Recommendations** For versions prior to 6.8.1, update to version 6.8.1 or later to resolve the issue. As a temporary workaround, consider disabling the `extend` function in `Collection.js/dist/node/iterators/extend.js` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dot-lens versions all **Description** The issue concerns Prototype Pollution via the `set()` function in the `index.js` file. This affects all versions of the dot-lens package. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** For all versions, consider disabling the `set()` function in the `index.js` file as a temporary workaround until a patch is available. Restrict access to the `index.js` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** utilities (affected versions not specified) **Description** The issue concerns Prototype Pollution via the ` mix` function. This affects all versions of the package utilities. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rangy versions all **Description** The issue concerns Prototype Pollution in the rangy package. It occurs when using the `extend()` function in the file `rangy-core.js`, which utilizes a recursive merge. This can allow an attacker to modify properties of the `Object.prototype`. **Recommendations** For all versions, consider disabling the `extend()` function in `rangy-core.js` as a temporary workaround until a patch is available. Restrict access to the `rangy-core.js` file to minimize the risk of exploitation. Avoid using the `extend()` function in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** safe-eval versions all **Description** The issue allows an attacker to add or modify properties of the Object.prototype through Prototype Pollution when using the function safeEval. This is due to the function's use of the vm variable, enabling an attacker to modify properties of the Object.prototype. **Recommendations** For all versions, consider disabling the use of the safeEval function until a patch is available to prevent exploitation. Restrict access to the vm variable to minimize the risk of modifying the Object.prototype properties.

**Name of the Vulnerable Software and Affected Versions** jsgui-lang-essentials (affected versions not specified) **Description** The issue allows alteration of all Object attributes, including magical attributes such as `proto`, `constructor`, and `prototype`, leading to Prototype Pollution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.