GHSA-c3px-v9c7-m734: 
JavaScript vulnerability analysis and mitigation

A high-severity prototype pollution vulnerability was identified in the Mithril JavaScript framework, tracked as GHSA-c3px-v9c7-m734. The vulnerability affects Mithril versions < 1.1.7 and versions >= 2.0.0, < 2.0.2. This security issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023 (GitHub Advisory).

The vulnerability exists in the parseQueryString function of Mithril, which is susceptible to prototype pollution attacks. The function allows malicious users to modify the prototype of Object, enabling the addition or modification of existing properties that will affect all objects. For example, a query string payload like 'proto%5BtoString%5D=123' could be used to change the toString() function to '123'. The vulnerability is classified under CWE-1321 and has been assigned a high severity rating (GitHub Advisory).

When exploited, this vulnerability allows attackers to modify properties that exist on all objects in the application by polluting the Object prototype. This can lead to application-wide property modifications and potentially affect the behavior of the entire application (GitHub Advisory).

The vulnerability can be exploited by manipulating query string parameters to inject malicious payloads that target the Object prototype. The attack vector involves sending specially crafted query strings that can modify global object properties (GitHub Advisory).

Users are advised to upgrade their Mithril installations to patched versions. For Mithril 2.x users, upgrading to version 2.0.2 or later is recommended. For Mithril 1.x users, upgrading to version 1.1.7 or later will resolve the vulnerability (GitHub Advisory, NPM Advisory).