CVE-2020-5259: 
JavaScript vulnerability analysis and mitigation

In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. The vulnerability, identified as CVE-2020-5259, affects multiple versions including <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, and 1.16.0-1.16.1. The issue was disclosed in March 2020 (GitHub Advisory).

The vulnerability exists in the Dojox jQuery wrapper's jqMix mixin method. The issue allows an attacker to manipulate attributes to overwrite or pollute a JavaScript application object prototype of the base object by injecting other values. The vulnerability was patched by preventing the special proto property name from being mixed in, which previously could pollute the prototype of the object being mixed into in the jqMix function in jq.js (GitHub Commit).

An attacker could exploit this vulnerability to manipulate attributes and overwrite or pollute JavaScript application object prototypes of the base object by injecting malicious values. This could potentially lead to application security compromises through prototype pollution attacks (Debian Security).

The vulnerability has been patched in versions 1.16.2, 1.15.3, 1.14.6, 1.13.7, 1.12.8, and 1.11.10. Users are recommended to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).