CVE-2020-36632: 
JavaScript vulnerability analysis and mitigation

A critical vulnerability was discovered in hughsk flat versions up to 5.0.0, affecting the unflatten function in the index.js file. The vulnerability was disclosed on December 25, 2022 and tracked as CVE-2020-36632 (NVD, FortiGuard).

The vulnerability is a prototype pollution issue in the unflatten function that allows attackers to inject malicious properties into Object.prototype. The vulnerability occurs due to improper input validation when processing nested object properties (GitHub Issue). An attacker can exploit this by passing specially crafted input containing 'proto' properties to the unflatten function.

Successful exploitation of this vulnerability could allow attackers to modify properties within the global prototype chain, potentially leading to denial of service (DoS) at minimum. The vulnerability could also enable injection-based attacks depending on how the library is integrated within applications (GitHub PR).

The vulnerability can be exploited by calling the unflatten function with malicious input. A proof of concept demonstrates exploitation by using: unflatten({'proto.polluted': true}), which results in polluted being set to true globally (GitHub Issue).

The vulnerability was patched in version 5.0.1 of the flat package. The fix prevents prototype pollution by checking for 'proto' keys and returning early when encountered (GitHub Commit). Users are strongly recommended to upgrade to version 5.0.1 or later.