This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.

All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.

The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.

All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.

The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.

This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

All versions of package deeps are vulnerable to Prototype Pollution via the set function.

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.

All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.

The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.

All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.

In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.

All versions of package confucious are vulnerable to Prototype Pollution via the set function.

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.

All versions of phpjs are vulnerable to Prototype Pollution via parse_str.

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.

Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.