babel-plugin-transform-cssobj (=3.0.2), cssobj-converter (>=2.1.2 <=2.4.3) +5 more potentially affected by unknown CVE via objutil (>=2.0.2 <=2.17.4)

objutil NPM version =2.0.2, =2.1.2, =1.0.1, =1.0.0, =0.0.5, =0.0.21 Source cves: unknown CVE Source advisory: SNYK:JS-OBJUTIL-559496...

Prototype Pollution

Overview objutil is a Javascript Object util methods with deep traverse, with ES6 tree shaking methods. Affected versions of this package are vulnerable to Prototype Pollution. The merge method could be tricked into adding or modifying properties of Object.prototype. PoC var a = x:1,y: w:1, z:2 v...