CVE-2021-23402

CVE-2021-23402 is a critical Prototype Pollution vulnerability affecting all versions of the record-like-deep-assign package. This flaw allows an unauthenticated attacker to inject arbitrary properties into JavaScript object prototypes, potentially leading to remote code execution or denial of service. With a CVSS score of 9.8, it presents a high risk due to its network-based attack vector and low complexity, enabling full compromise of confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.