CVE-2019-11358

CVE-2019-11358 describes a prototype pollution vulnerability in jQuery versions prior to 3.4.0, impacting products like Drupal and Backdrop CMS. This flaw allows an attacker to modify the native Object.prototype if an unsanitized source object containing an enumerable __proto__ property is processed by jQuery.extend(true, {}, ...). Rated as Medium severity (CVSS 6.1), it requires user interaction (UI:R) and could lead to partial confidentiality and integrity impacts (C:L/I:L). While not in the KEV catalog, an ExploitDB entry (EDB-52141) exists, and there is some community discussion, though no active exploitation or widespread media coverage is noted.