GHSA-6cj2-92m5-7mvp: 
JavaScript vulnerability analysis and mitigation

A high severity vulnerability (GHSA-6cj2-92m5-7mvp, CVE-2021-32736) was discovered in think-config npm package affecting versions below 1.1.3. The vulnerability was published on July 24, 2021, and involves improper control of object prototype attribute modifications, also known as Prototype Pollution. The issue was identified by security researcher yoshino-s (GitHub Advisory).

The vulnerability is classified as CWE-1321 and received a CVSS v3.1 score of 7.5 (High). The technical assessment indicates that the vulnerability can be exploited over the network with low attack complexity, requires no privileges or user interaction, and has an unchanged scope. While there is no impact on confidentiality and availability, the integrity impact is rated as high (GitHub Advisory).

The vulnerability allows an attacker to modify object prototype attributes through input from an upstream component. This can lead to significant integrity issues as the software fails to properly control modifications of attributes of the object prototype (GitHub Advisory).

The vulnerability has been patched in think-config version 1.1.3. Users are strongly advised to upgrade to version 1.1.3 or higher to address this security issue (GitHub Advisory).