CVE-2021-25947: 
JavaScript vulnerability analysis and mitigation

A prototype pollution vulnerability was discovered in the 'nestie' package affecting versions 0.0.0 through 1.0.0. The vulnerability was disclosed on June 3, 2021, and assigned identifier CVE-2021-25947. The vulnerability affects the nestie() function in the NPM module, which fails to properly validate input parameters (WhiteSource DB).

The vulnerability exists in the nestie() function which accepts 'input' and 'glue' as arguments. Due to lack of type checking before assigning values to properties, an attacker can supply malicious values that include the 'proto' property. The absence of validation to check whether the assigned argument is the Object's own property allows direct property assignment to new objects, thereby polluting the Object prototype. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (WhiteSource DB).

Successful exploitation of this vulnerability can allow attackers to cause denial of service conditions and potentially achieve remote code execution. When exploited, the vulnerability enables attackers to manipulate or create non-existent properties, which can affect the behavior of the application (WhiteSource DB).

The vulnerability can be exploited by passing specially crafted input to the nestie() function. A proof of concept demonstrates that an attacker can pollute the Object prototype by setting a 'polluted' property through the 'proto' object, which then affects all newly created objects in the application (WhiteSource DB).

Users are advised to upgrade to version 1.0.1 which contains fixes for this vulnerability (WhiteSource DB).