CVE-2020-7721: 
JavaScript vulnerability analysis and mitigation

All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. The vulnerability was discovered on August 14, 2020, and publicly disclosed on September 1, 2020. This security issue affects all versions of the node-oojs package, which is an Object Oriented JavaScript library (Snyk).

The vulnerability allows Prototype Pollution through the setPath function. The issue occurs when an attacker can manipulate JavaScript language construct prototypes by injecting properties into existing objects. A proof of concept demonstrates that calling oojs.setPath({'proto.polluted':true}) results in polluted being accessible globally. The vulnerability has been assigned a CVSS score of 9.8 (Critical), indicating its severe impact (Snyk).

The vulnerability can lead to multiple severe consequences: Denial of Service (DoS) by triggering JavaScript exceptions, potential Remote Code Execution (RCE) through manipulation of code paths, and Property Injection allowing attackers to modify security-critical properties. The vulnerability affects various environments including application servers, web servers, and web browsers (Snyk).

The vulnerability has a high exploitability potential as Snyk has developed a proof-of-concept exploit. The EPSS (Exploit Prediction Scoring System) indicates a 1.22% probability of exploitation (86th percentile), suggesting a significant likelihood of exploitation in the wild (Snyk).

Since there is no fixed version available for node-oojs, the following preventive measures are recommended: freeze the prototype using Object.freeze(Object.prototype), implement schema validation for JSON input, avoid unsafe recursive merge functions, use objects without prototypes (Object.create(null)), and consider using Map instead of Object (Snyk).