CVE-2020-7616: 
JavaScript vulnerability analysis and mitigation

express-mock-middleware through version 0.0.6 contains a Prototype Pollution vulnerability (CVE-2020-7616). The vulnerability was discovered and disclosed on April 1, 2020, by the JHU System Security Lab. The package is a simple mock middleware for Express.js applications (Snyk).

The vulnerability allows attackers to add or modify properties of the Object.prototype through exported functions. The exploitation requires creating a new directory where attack code can be placed, which will then be exported by express-mock-middleware. The vulnerability stems from insufficient input sanitization when parsing exported functions (Snyk).

While the vulnerability allows for Prototype Pollution, the impact is considered low risk due to the specific exploitation requirements. The successful exploitation could lead to Denial of Service (DoS) conditions and potential property modifications in the Object prototype chain (Snyk).

There is no fixed version available for express-mock-middleware. Users should consider using alternative packages or implementing additional input validation measures (Snyk).