CVE-2020-28269: 
JavaScript vulnerability analysis and mitigation

Prototype pollution vulnerability affects the 'field' NPM module versions 0.0.1 through 1.0.1. The vulnerability allows attackers to cause a denial of service and potentially achieve remote code execution. The issue was disclosed on November 12, 2020, and received a critical CVSS v3.1 base score of 9.8 (NVD, WhiteSource).

The vulnerability exists in the set() function of the field module, which fails to validate input types before assigning values to object properties. The function accepts three arguments: topObj, fields, and value, but lacks proper validation for the fields and value parameters. This allows attackers to manipulate object properties through prototype pollution by including the __proto__ property in the fields argument. The vulnerability is tracked as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) (NVD, WhiteSource).

The vulnerability can lead to denial of service conditions and potentially remote code execution. When exploited, attackers can create non-existent properties or manipulate existing properties of objects. For example, if there's a security check that validates an isAdmin property, the attacker could pollute the Object prototype to set this value to true, bypassing security controls (WhiteSource).

The vulnerability is easily exploitable with network access and requires no special privileges or user interaction. A proof of concept exists that demonstrates how an attacker can pollute the Object prototype by setting arbitrary properties. The attack can be performed by supplying malicious input to the set() function, specifically targeting the __proto__ property (WhiteSource).

Several mitigation strategies are available: 1) Freeze objects to prevent adding, removing, or changing properties, 2) Implement JSON input validation with schema validation to ensure only predefined attributes are allowed, 3) Use Object.create to create objects without prototype association. However, no fixed version of the package is available as the repository was archived on October 21, 2020 (WhiteSource).