CVE-2023-26158: 
JavaScript vulnerability analysis and mitigation

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. The vulnerability was disclosed on November 7, 2023, and published on December 8, 2023 (NVD, Snyk).

The vulnerability exists in the Util.extend function where user-controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler, or Mock.Util can be exploited. The issue stems from improper input sanitization that allows the usage of dangerous attributes like 'proto', 'constructor', and 'prototype' (Snyk).

By adding or modifying attributes of an object prototype, attackers can create attributes that exist on every object or replace critical attributes with malicious ones. This can be problematic if the software depends on the existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype such as hasOwnProperty, toString, or valueOf (Snyk).

As there is no fixed version available, a workaround has been provided that involves using a denylist of dangerous attributes. The recommended solution is to add a check in the Util.extend function that prevents the use of 'proto', 'constructor', and 'prototype' attributes (Snyk).