CVE-2021-20087: 
JavaScript vulnerability analysis and mitigation

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') was discovered in jquery-deparam version 0.5.1. The vulnerability was assigned CVE-2021-20087 and was disclosed on April 23, 2021. This vulnerability allows a malicious user to inject properties into Object.prototype through the jquery-deparam library (NVD, MITRE).

The vulnerability exists in the deparam function of jquery-deparam 0.5.1, which fails to properly validate user input when parsing parameters. The function allows manipulation of object properties through specially crafted parameters using __proto__ or constructor.prototype notation. The vulnerability has been assigned a CVSS score of 6.5, indicating medium severity (Client Side PP).

When exploited, this vulnerability allows attackers to modify the Object.prototype, which affects all JavaScript objects in the application. This can lead to application behavior manipulation, potential denial of service, and in some cases may enable cross-site scripting (XSS) attacks if combined with other vulnerabilities (CISA).

Users should upgrade to a patched version of the library if available. If upgrading is not possible, implement input validation to prevent prototype pollution attacks by blocking parameters containing __proto__ or constructor.prototype patterns (NVD).