Jqwidgets
Monthly
Prototype pollution in jQWidgets up to version 24.0.1 allows remote unauthenticated attackers to manipulate JavaScript object prototypes via the `JQXLite.extend` and `jqxBaseFramework.extend` functions in `jqwidgets/jqx-all.js`. Successful exploitation can affect the confidentiality, integrity, and availability of any web application embedding this library. Critically, the vendor closed the tracking GitHub issue as 'not planned,' meaning no official patch exists or is expected, leaving all consumers permanently exposed without mitigation.
Prototype pollution in jQWidgets up to version 24.0.1 allows remote unauthenticated attackers to manipulate JavaScript object prototypes via the `JQXLite.extend` and `jqxBaseFramework.extend` functions in `jqwidgets/jqx-all.js`. Successful exploitation can affect the confidentiality, integrity, and availability of any web application embedding this library. Critically, the vendor closed the tracking GitHub issue as 'not planned,' meaning no official patch exists or is expected, leaving all consumers permanently exposed without mitigation.