CVE-2020-7637: 
JavaScript vulnerability analysis and mitigation

class-transformer before version 0.3.1 contains a Prototype Pollution vulnerability. The classToPlainFromExist function could be exploited by attackers to add or modify properties of Object.prototype using a proto payload. The vulnerability was discovered and disclosed on April 5, 2020 (SNYK Vuln).

The vulnerability exists in the classToPlainFromExist function where attackers could manipulate properties of Object.prototype through a specially crafted proto payload. The vulnerability has been assigned a CVSS v3.1 base score of 4.2 (Medium), with attack vector being Network, attack complexity High, and requiring low privileges with no user interaction (SNYK Vuln).

When successfully exploited, this Prototype Pollution vulnerability could lead to denial of service by triggering JavaScript exceptions or potentially enable tampering with application source code. The attack could affect the integrity of the application by allowing modification of data, though the attacker's control over the modification consequences is limited (SNYK Vuln).

The vulnerability has been fixed in class-transformer version 0.3.1. Users should upgrade to this version or higher to mitigate the risk. The fix involves adding checks to prevent processing of proto and constructor properties in the transformation process (GitHub Commit).