CVE-2020-28450: 
JavaScript vulnerability analysis and mitigation

CVE-2020-28450 affects all versions of the decal JavaScript package. The vulnerability was discovered in the extend function and was disclosed on December 14, 2020, with publication following on February 4, 2021 (Snyk). The vulnerability was identified by Nikita Stupin of Advanced Software Technology Lab / Divine Rapier Security Lab of GTS Huawei.

The vulnerability is classified as a Prototype Pollution issue with a CVSS v3.1 score of 8.6 (High). The vulnerability exists in the extend function of the decal package, which allows for unsafe recursive merge operations that can lead to prototype pollution (Snyk).

The vulnerability can lead to multiple severe consequences: Denial of Service (DoS) through manipulation of Object prototype attributes, potential Remote Code Execution if the codebase evaluates and executes specific object attributes, and Property Injection where an attacker can pollute security-critical properties like privileges or tokens (Snyk).

The vulnerability has a proof-of-concept exploit available. According to the EPSS score, it has a 0.97% probability of exploitation (84th percentile), indicating a moderate likelihood of exploitation in the wild (Snyk).

Currently, there is no fixed version available for the decal package. Recommended mitigations include freezing the prototype using Object.freeze(Object.prototype), implementing JSON input schema validation, avoiding unsafe recursive merge functions, using objects without prototypes (Object.create(null)), and considering the use of Map instead of Object (Snyk).