toggle-array Prototype Pollution Vulnerability Allowing Denial-of-Service

A prototype pollution vulnerability has been identified in the toggle-array package, specifically in versions through 1.0.1. This vulnerability allows attackers to inject properties into Object.prototype by sending a crafted payload. The exploitation of this vulnerability can lead to a denial-of-service condition, at a minimum.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by injecting properties into Object.prototype, which can disrupt the normal operation of the application.

Reproduction

The vulnerability can be reproduced by using the toggle-array package in a version prior to 1.0.1. After importing the package, the enable or disable function can be called with a crafted payload that targets Object.prototype. This injection can then be exploited to cause a denial-of-service condition.