CVE-2021-23329: 
JavaScript vulnerability analysis and mitigation

The package nested-object-assign before version 1.0.4 was discovered to contain a Prototype Pollution vulnerability (CVE-2021-23329). The vulnerability was identified and disclosed on January 31, 2021. This security issue affects the default function of the package, which is designed to support nested merging of objects and properties using Object.Assign (Snyk).

The vulnerability allows an attacker to inject properties into existing JavaScript language construct prototypes through the package's default function. JavaScript permits alteration of all Object attributes, including magical attributes like proto, constructor, and prototype. When exploited, properties on the Object.prototype are inherited by all JavaScript objects through the prototype chain. The vulnerability was assigned a CVSS score of 7.5 (High) (Snyk).

When successfully exploited, this vulnerability can lead to either denial of service by triggering JavaScript exceptions or tampering with the application source code to force the code path that the attacker injects. This could potentially lead to remote code execution. The vulnerability primarily affects the availability of the system, with potential for property injection attacks that could compromise application security (Snyk).

The vulnerability has a proof-of-concept exploit available. An attacker can exploit this vulnerability by providing specially crafted input that includes Object.prototype manipulation. A simple proof of concept demonstrates that an attacker can pollute the prototype chain by using the package's default function with malicious JSON input (GitHub PR, Snyk).

The vulnerability has been fixed in version 1.0.4 of the nested-object-assign package. Users should upgrade to this version or higher to mitigate the risk. Alternative mitigation strategies include freezing the prototype using Object.freeze(Object.prototype), requiring schema validation of JSON input, avoiding unsafe recursive merge functions, and considering the use of objects without prototypes or using Map instead of Object (Snyk).