A prototype pollution vulnerability in the jsondiffpatch package allows remote attackers to manipulate object properties, leading to potential denial of service or application logic bypass.

This vulnerability (CWE-1321) occurs due to improper handling of user-controlled input during the diffing or patching process. It allows an unauthenticated attacker to inject properties into the JavaScript runtime's object prototypes.

Prototype pollution can be used to alter application behavior, bypass security checks, or trigger application crashes. Given the CVSS score of 8.2, the potential for widespread impact on services relying on this library is significant, potentially leading to unauthorized data manipulation or critical service outages.

Immediate Action: Update the jsondiffpatch dependency to version 0.7.6 or later.

Proactive Monitoring: Monitor application behavior for unexpected changes in object states or anomalous errors that may indicate successful prototype pollution attempts.

Compensating Controls: Utilize security linting tools and static analysis to identify potential prototype pollution sinks in the application code.

Public Exploit Available: Unknown — no weaponized exploit or public PoC repository identified in available data; however, technical details and fix commits are public.

Prototype pollution is a subtle but high-impact vulnerability. Organizations utilizing jsondiffpatch should prioritize dependency updates as part of their standard software supply chain security practices to mitigate the risk of exploitation.