CVE-2020-28499: 
JavaScript vulnerability analysis and mitigation

All versions of package merge before 2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge function. The vulnerability was discovered on November 22, 2020, and publicly disclosed on February 18, 2021. This vulnerability has been assigned CVE-2020-28499 and affects the merge package, a library that allows merging multiple objects into one (Snyk JS).

The vulnerability exists in the _recursiveMerge function where improper input sanitization allows for prototype pollution. The severity is rated as HIGH with a CVSS v3.1 base score of 7.3 by Snyk and 9.8 (CRITICAL) by NVD. The vulnerability can be exploited remotely without requiring privileges or user interaction (NVD).

When exploited, this vulnerability allows attackers to modify properties within the global prototype chain. This can lead to denial of service by triggering JavaScript exceptions or potentially enable remote code execution by tampering with the application source code. The vulnerability affects confidentiality, integrity, and availability of the system (Snyk JS).

A proof-of-concept exploit exists demonstrating how an attacker can pollute Object.prototype by injecting malicious properties. The attack can be executed by passing specially crafted JSON input containing proto properties to the merge.recursive function (Snyk JS).

The vulnerability has been patched in version 2.1.1 of the merge package. Users should upgrade to this version or higher. Alternative mitigations include freezing the prototype using Object.freeze(Object.prototype), requiring schema validation of JSON input, avoiding unsafe recursive merge functions, and considering the use of objects without prototypes (Object.create(null)) (Snyk JS).