CVE-2024-57074 Details

A prototype pollution vulnerability has been identified in the xe-utils library, specifically in version 3.5.31. The issue arises in the 'lib.merge' function, where attackers can supply a crafted payload to introduce or modify properties within the global prototype chain. This manipulation can cause a denial-of-service condition and potentially escalate to other injection-based attacks, depending on how xe-utils is integrated within the application. For example, if the polluted property affects sensitive Node.js APIs like 'exec' or 'eval', it could allow execution of arbitrary commands in the application's context.