CVE-2019-10806: 
JavaScript vulnerability analysis and mitigation

vega-util prior to version 1.13.1 contains a Prototype Pollution vulnerability identified as CVE-2019-10806. The vulnerability exists in the 'vega.mergeConfig' method within vega-util, which could be tricked into adding or modifying properties of the Object.prototype (NVD Results, Snyk Report).

The vulnerability is rated with a CVSS v3.1 Base Score of 4.3 (Medium) and a CVSS v2.0 Base Score of 4.0 (Medium). The issue stems from the mergeConfig method not properly validating input, allowing manipulation of the object prototype. The vulnerability was discovered by Sam Sanoop of the Snyk Security Team (Snyk Report).

When exploited, this vulnerability could allow attackers to modify properties of Object.prototype, potentially leading to Denial of Service conditions and affecting the integrity of the application. The impact is considered medium severity as it can cause performance reduction and interruptions in resource availability (Snyk Report).

The vulnerability has a proof-of-concept exploit available. The attack complexity is rated as High, requiring specific conditions to be met for successful exploitation. The vulnerability can be exploited without user interaction and requires low privileges (Snyk Report).

The recommended mitigation is to upgrade vega-util to version 1.13.1 or higher. The fix involves implementing proper input validation by adding checks for illegal keys, particularly 'proto', in the mergeConfig function (GitHub Commit).