GHSA-5947-m4fg-xhqg: 
JavaScript vulnerability analysis and mitigation

A high-severity Prototype Pollution vulnerability was identified in lodash.mergewith package versions prior to 4.6.1. The vulnerability was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. This security issue affects the npm package lodash.mergewith and is tracked under the identifier GHSA-5947-m4fg-xhqg (GitHub Advisory).

The vulnerability exists in the 'mergeWith' function of the lodash.mergewith package. The issue allows malicious users to modify the prototype of Object through the proto property, enabling the addition or modification of existing properties that will persist across all objects. The vulnerability is classified under CWE-1321 and has been assigned a High severity rating (GitHub Advisory).

When exploited, this vulnerability allows attackers to modify properties that will exist on all objects through prototype pollution, potentially affecting the entire application's object hierarchy (GitHub Advisory).

The vulnerability can be exploited by manipulating the proto property through the 'mergeWith' function, allowing unauthorized modification of object prototypes (GitHub Advisory).

Users are recommended to update to version 4.6.1 or later of the lodash.mergewith package to address this vulnerability (GitHub Advisory, NPM Advisory).