CVE-2020-28442: 
JavaScript vulnerability analysis and mitigation

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function. The vulnerability was discovered on October 29, 2020, and publicly disclosed on December 14, 2020. This vulnerability affects the js-data package, which is a robust, framework-agnostic in-memory data store (Snyk Advisory).

The vulnerability exists in the deepMixIn and deepFillIn functions of the js-data package. The issue allows an attacker to manipulate JavaScript's object prototype chain through unsafe recursive merge operations. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NVD and 7.5 (HIGH) by Snyk. The vulnerability is tracked as CVE-2020-28442 and is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) (Snyk Advisory).

When exploited, this vulnerability can lead to either denial of service by triggering JavaScript exceptions or tampering with the application source code to force the code path that the attacker injects. This can potentially lead to remote code execution. The vulnerability affects multiple environments including application servers, web servers, and web browsers (Snyk Advisory).

The vulnerability has a proof-of-concept exploit available. An attacker can exploit this vulnerability by supplying a payload with Object.prototype setter to introduce or modify properties within the global prototype chain. The exploit requires no privileges and can be executed without user interaction (Snyk Advisory).

For versions before 3.0.10, users should upgrade to version 3.0.10 or higher to fix this vulnerability. Additionally, several preventive measures can be implemented: 1) Freeze the prototype using Object.freeze(Object.prototype), 2) Require schema validation of JSON input, 3) Avoid using unsafe recursive merge functions, 4) Consider using objects without prototypes (Object.create(null)), and 5) Use Map instead of Object as a best practice (Snyk Advisory).