CVE-2024-57082: 
JavaScript vulnerability analysis and mitigation

A prototype pollution vulnerability exists in the lib.createUploader function of @rpldy/uploader version 1.8.1. The vulnerability was disclosed on February 5, 2025, and affects the @rpldy/uploader package. The issue allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload (NVD, GitHub POC).

The vulnerability exists in the lib.createUploader function where improper input validation allows an attacker to introduce or modify properties within the global prototype chain. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue has been classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

Successful exploitation of this vulnerability can lead to Denial of Service (DoS) as the minimum consequence. Additionally, depending on how the library integrates within the application, the vulnerability could potentially escalate to other injection-based attacks. If the polluted property propagates to sensitive Node.js APIs (such as exec or eval), it could enable an attacker to execute arbitrary commands within the application's context (GitHub POC).

The vulnerability can be exploited by supplying a crafted payload to the lib.createUploader function. A proof of concept exploit has been published demonstrating how an attacker can modify properties within the global prototype chain (GitHub POC).