Description
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
Remediation
References
https://github.com/xcritical-software/utilitify/commit/88d6e27009823338bf319ffb768fe6b08e8ad2d1%2C
https://snyk.io/vuln/SNYK-JS-UTILITIFY-559497
Related Vulnerabilities
CVE-2023-36469 Vulnerability in maven package org.xwiki.platform:xwiki-platform-notifications-ui
CVE-2013-3300 Vulnerability in maven package net.liftweb:lift-json_2.9.1
CVE-2020-28481 Vulnerability in maven package org.webjars.npm:socket.io
CVE-2023-24621 Vulnerability in maven package com.esotericsoftware.yamlbeans:yamlbeans