A critical prototype pollution vulnerability in the Vuetify framework allows unauthenticated attackers to manipulate JavaScript object prototypes, potentially leading to denial of service or unauthorized access.

This is an improper control of object prototype attributes (CWE-1321) vulnerability. An unauthenticated attacker can supply a malicious preset to the mergeDeep utility function, resulting in the pollution of global JavaScript objects which affects the entire application state or server process if Server-Side Rendering is used.

The ability to pollute object prototypes presents a high risk to application security and availability. By modifying object behavior, attackers can trigger resource exhaustion, bypass security controls, or gain unauthorized access to sensitive data. Given the CVSS score of 8.6, this flaw is considered high severity, as it can be exploited remotely without authentication to impact the integrity and availability of the entire application environment.

Immediate Action: Since Vuetify 2.x is officially End-of-Life and will not receive security patches, organizations must migrate to a supported version of Vuetify or implement strict input validation to sanitize all configuration presets before they are processed by the application.

Proactive Monitoring: Monitor application logs for unexpected changes in object behavior or unusual error patterns that may indicate attempts to inject malicious configuration objects.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and inspect incoming requests for suspicious JSON structures or payloads that attempt to manipulate prototype attributes.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record (https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755).

This vulnerability represents a significant risk because the affected software version is no longer supported by the vendor. Organizations relying on Vuetify 2.x must prioritize an immediate migration strategy to a supported release to eliminate this attack vector, as no official patch will be provided to remediate this flaw.