Prototype Pollution

Vulnerability

The package x-assign (all versions) is vulnerable to prototype pollution. The assign function recursively merges objects without sanitizing the __proto__ property, allowing an attacker to pollute the global Object.prototype [1][2].

Exploitation

An attacker can pass a crafted object with a __proto__ key to the assign function. Because the merge recursively copies properties without checking for __proto__, the attacker's properties are injected into the prototype chain. No authentication is required if the attacker controls the input source [2].

Impact

Successful exploitation leads to prototype pollution, which can cause denial of service (throwing exceptions) or, in some contexts, remote code execution by manipulating application behavior [2].

Mitigation

No fix has been released for x-assign. Users should avoid using the package or switch to an alternative that sanitizes __proto__. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.