CVE-2021-4329: 
JavaScript vulnerability analysis and mitigation

A critical vulnerability (CVE-2021-4329) was discovered in json-logic-js version 2.0.0. The vulnerability relates to the operations object, which could be exploited to run arbitrary code. The issue was identified and fixed in version 2.0.1, released on March 30, 2021 (GitHub Commit).

The vulnerability exists in the way the operations object handles function calls. The original implementation did not properly validate operation access, which could allow an attacker to execute arbitrary code through prototype pollution. The fix involved adding proper property ownership checks using hasOwnProperty before executing operations (GitHub PR).

If exploited, this vulnerability could allow attackers to execute arbitrary code through the operations object, potentially leading to complete system compromise in applications using the affected version of json-logic-js.

Users should upgrade to json-logic-js version 2.0.1 or later, which contains the security fix. The patch implements proper validation of operations using hasOwnProperty checks to prevent arbitrary code execution (GitHub Commit).