Inputmask
Monthly
Prototype pollution in RobinHerbots Inputmask up to version 5.0.9 allows low-privileged remote attackers to manipulate JavaScript's shared Object.prototype via the internal deep merge helper functions extendDefaults, extendDefinitions, and extendAliases in lib/dependencyLibs/extend.js. Successful exploitation enables injection of arbitrary properties onto the global prototype chain, potentially leading to information disclosure, logic bypass, or application state manipulation within any JavaScript runtime consuming the library with attacker-influenced configuration input. No vendor patch is available as the project has not responded to the responsible disclosure report filed via GitHub issue #2885; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prototype pollution in RobinHerbots Inputmask up to version 5.0.9 allows low-privileged remote attackers to manipulate JavaScript's shared Object.prototype via the internal deep merge helper functions extendDefaults, extendDefinitions, and extendAliases in lib/dependencyLibs/extend.js. Successful exploitation enables injection of arbitrary properties onto the global prototype chain, potentially leading to information disclosure, logic bypass, or application state manipulation within any JavaScript runtime consuming the library with attacker-influenced configuration input. No vendor patch is available as the project has not responded to the responsible disclosure report filed via GitHub issue #2885; no public exploit code or CISA KEV listing has been identified at time of analysis.