CVE-2023-30857: 
JavaScript vulnerability analysis and mitigation

@aedart/support, a support package for Ion (a monorepo for JavaScript/TypeScript packages), was found to contain a prototype pollution vulnerability (CVE-2023-30857) prior to version 0.6.1. The vulnerability was discovered in the MetadataRecord component when merged with a base class' metadata object in the meta decorator (NVD, GitHub Advisory).

The vulnerability is classified as a prototype pollution issue (CWE-1321) with a CVSS v3.1 Base Score of 3.7 (LOW). The attack vector is network-based with high attack complexity, requiring no privileges or user interaction. The scope is unchanged, with no impact on confidentiality or availability but low impact on integrity (NVD).

The impact of this vulnerability is considered low, as exploitation requires specific conditions. The vulnerability only becomes relevant when a class is decorated using the meta() decorator, and sensitive objects would need to be stored as metadata for any security impact to occur (GitHub Advisory).

The vulnerability has been patched in version 0.6.1 of @aedart/support. The fix involves using Object.create(null) instead of an empty object when creating new metadata records (GitHub Patch).