CVE-2024-24293: 
JavaScript vulnerability analysis and mitigation

A Prototype Pollution vulnerability (CVE-2024-24293) affects MiguelCastillo @bit/loader version 10.0.3. The vulnerability allows an attacker to execute arbitrary code via the M function e argument in index.js (CVE Details).

The vulnerability occurs when the merge is invoked in M function unsafely. The issue stems from missing checks on the infected e argument with proto object to verify if it resolves to the object prototype. This allows malicious properties to be copied onto the Object prototype through merge operations to an empty object, which then recursively affects all objects in the program (GitHub POC).

When successfully exploited, the vulnerability allows attackers to modify the Object prototype, potentially leading to arbitrary code execution. The attack can affect all objects in the program through prototype pollution, as demonstrated by the ability to inject arbitrary properties into Object.prototype (GitHub POC).

A proof of concept exists demonstrating the vulnerability's exploitation. The attack can be executed by passing a specially crafted JSON object containing proto properties to the affected function (GitHub POC).

As there are no security updates available for this vulnerability, users should implement proper sanitization and validation of user-supplied inputs. This includes blocking inputs containing proto and constructor.prototype. The vulnerability was disclosed publicly after four months of no response from the maintainer (GitHub POC).