CVE-2020-35149: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-35149 affects mquery versions before 3.2.3. The issue exists in lib/utils.js where a prototype pollution attack is possible because special properties (such as proto) can be copied during merge or clone operations (NVD).

The vulnerability has a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue specifically occurs in the library's merge and clone functionality where special properties like proto could be manipulated during operations (NVD).

The vulnerability allows attackers to alter code behavior by modifying object properties through prototype pollution. This could lead to potential code injection attacks (Red Hat).

The vulnerability is exploitable remotely without requiring authentication or user interaction. An attacker can craft special payloads containing properties like proto to trigger the prototype pollution (NVD).

The issue has been fixed in mquery version 3.2.3. The fix involves adding checks to avoid copying special properties like proto, constructor, and prototype during merge and clone operations (GitHub Patch).