CVE-2020-28277: 
JavaScript vulnerability analysis and mitigation

Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attackers to cause a denial of service and may lead to remote code execution. The vulnerability was discovered and disclosed in December 2020 (WhiteSource DB, NVD).

The vulnerability exists in the NPM module 'dset' where the export function accepts three arguments (obj, keys, val) but fails to validate input types before property assignment. Due to the absence of validation for values passed into 'keys' and 'val' arguments, attackers can supply malicious values by adjusting the 'keys' value to include the 'proto' property. This allows direct property assignment to the Object prototype without checking whether the assigned 'keys' is the Object's own property (WhiteSource DB).

The vulnerability can lead to denial of service conditions and potentially remote code execution. When exploited, attackers can create non-existent properties or manipulate existing properties in the Object prototype. This manipulation can affect all objects in the application, potentially compromising the entire system's security (WhiteSource DB).

The vulnerability is easily exploitable through a simple proof of concept that involves creating an empty object and using dset to pollute its prototype. The exploit requires no special privileges or complex conditions to execute. A proof of concept demonstrates that an attacker can set arbitrary properties on the Object prototype, which affects all objects in the application (WhiteSource DB, GitHub Issue).

Several mitigation strategies are available: 1) Freeze objects to prevent adding, removing, or changing properties, 2) Implement JSON input validation with schema validation to ensure only predefined attributes are allowed, 3) Use Object.create to create objects without prototype association. The vulnerability was ultimately fixed in a later version through a commit that addressed the prototype pollution issue (WhiteSource DB, GitHub Commit).