CVE-2020-28268: 
JavaScript vulnerability analysis and mitigation

Prototype pollution vulnerability affects 'controlled-merge' package versions 1.0.0 through 1.2.0. The vulnerability was discovered and disclosed on November 15, 2020, identified as CVE-2020-28268. The vulnerability exists in the merge() function of the package, which fails to properly validate object properties before assignment (WhiteSource, NVD).

The vulnerability stems from improper input validation in the merge() function, which accepts obj1, obj2, and attr arguments. The function does not verify the type of object before assigning values to properties, allowing manipulation of the Object prototype. An attacker can exploit this by supplying malicious values through the obj2 and attr parameters, particularly by including the 'prototype' property. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity (WhiteSource).

Successful exploitation of this vulnerability can lead to denial of service conditions and potentially remote code execution. When exploited, an attacker can create non-existent properties or manipulate existing properties in the Object prototype, affecting all objects in the application that inherit from the polluted prototype (WhiteSource).

The vulnerability can be exploited by passing specially crafted input to the merge() function. A proof of concept demonstrates that an attacker can pollute the Object prototype by creating a malicious object with a 'prototype' property, which then affects all objects inheriting from the polluted prototype (WhiteSource).

The recommended mitigation is to upgrade to version 1.3.0 of the controlled-merge package. The fix implements proper validation checks for object properties before assignment, preventing prototype pollution attacks. The patch was implemented in commit 5a4b2e9, which adds safety checks to prevent attr being specified as proto or non-object types (GitHub).