CVE-2024-57077 Details

A prototype pollution vulnerability has been identified in the utils-extend library, specifically in version 1.0.8. This vulnerability allows an attacker to manipulate the global prototype chain by supplying a payload with an Object.prototype setter. The immediate consequence is a denial-of-service (DoS) condition, but this vulnerability could also lead to more severe injection-based attacks, depending on how the library is used within an application. For example, if a polluted property is passed to sensitive Node.js APIs like exec or eval, it could allow an attacker to execute arbitrary commands in the application's context.