CVE-2020-28274: 
JavaScript vulnerability analysis and mitigation

Prototype pollution vulnerability was discovered in 'deepref' versions 1.1.1 through 1.2.1. The vulnerability was disclosed on December 8, 2020, and was assigned identifier CVE-2020-28274. This security issue affects the deepref package, which is a JavaScript/Node.js library (CISA Bulletin).

The vulnerability is classified as a prototype pollution issue with a CVSS base score of 7.5, indicating high severity. The flaw allows an attacker to cause a denial of service condition through manipulation of object properties, potentially leading to remote code execution. The vulnerability exists in versions 1.1.1 through 1.2.1 of the package (CISA Bulletin).

The exploitation of this vulnerability can result in two primary impacts: denial of service and potential remote code execution. This means an attacker could either disrupt the normal operation of applications using the affected versions of deepref or potentially execute arbitrary code on the target system (CISA Bulletin).

The vulnerability requires an attacker to have the ability to provide input that can be processed by the deepref library. When successfully exploited, it allows for prototype pollution which could lead to denial of service conditions or remote code execution scenarios (CISA Bulletin).

Users should upgrade to a patched version of the package that addresses this vulnerability. The issue has been fixed in versions after 1.2.1 (CONFIRM).