CVE-2020-28280

The predefine npm package, used to simplify Object.defineProperties, contains a prototype pollution vulnerability in its merge function. The flaw exists in the objectForEach loop within the merge function, where the condition if (target[key] === undefined) incorrectly allows assignment to __proto__ properties, thereby polluting Object.prototype [1][3]. This affects versions 0.0.0 through 0.1.2.

An attacker can exploit this by crafting a malicious object with a __proto__ property and passing it to the merge function. No authentication or special privileges are required, as the vulnerability can be triggered by processing user-supplied input. The attack surface includes any application that uses predefine.merge() on untrusted data [2].

Successful exploitation enables an attacker to inject arbitrary properties into the global object prototype, which can lead to denial of service (e.g., infinite loops or property shadowing) and potentially remote code execution if combined with other gadgets. The impact is limited only by the attacker's ability to control the input and the environment's usage of affected properties [1].

The issue has been addressed in commit 1a86a01 by adding an explicit check using has.call(target, key) to prevent prototype pollution [4]. Users are advised to upgrade to a patched version or apply the fix manually.