CVE-2021-25916: 
JavaScript vulnerability analysis and mitigation

Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 was discovered, which allows an attacker to cause a denial of service and potentially lead to remote code execution. The vulnerability was disclosed on March 16, 2021, affecting the NPM module 'patchmerge' (NVD, Mend Database).

The vulnerability stems from the module's failure to validate object types before property assignment. The module accepts two arguments 'original' and 'patch', and due to the absence of validation on values passed into the 'patch' argument, attackers can supply malicious values by including the 'proto' property. This allows direct property assignment to empty objects, thereby polluting the Object prototype. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to denial of service conditions and potentially remote code execution. When exploited, it allows attackers to create non-existent properties or manipulate existing properties in the Object prototype, which can affect the behavior of the application using the module (Mend Database).

The vulnerability is exploitable by adjusting the 'patch' value to include the 'proto' property. When there's no validation to check whether the assigned 'patch' is the Object's own property, malicious properties can be injected into the Object prototype. For example, if a property 'isAdmin' is injected, subsequent checks for this property would return 'true' due to the pollution (Mend Database).

The recommended mitigation is to upgrade to version 1.0.2 of the patchmerge module. A fix has been implemented that prevents inadvertent modification of Object.prototype by substituting an empty object when attempting to modify the prototype (GitHub Patch).