The vulnerability resides in the extendDefaults, extendDefinitions, and extendAliases functions of Inputmask's internal deep merge helper. An attacker can supply crafted data that causes the library to assign properties to the prototype of objects, enabling prototype pollution. This flaw can be used to inject new properties into all objects inheriting from the polluted prototype, thereby potentially altering application logic or data flow within the same execution context.

All releases of RobinHerbots Inputmask up to and including 5.0.9 are impacted. The component is widely employed in front‑end web applications to mask user input, making these environments susceptible if the vulnerable library is loaded.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score below 1% signals a very low probability of exploitation at present. The vulnerability can be triggered remotely by sending malicious input to the affected functions. It is not listed in CISA’s KEV catalog. Until an official patch or revision is released, the risk remains moderate, particularly for applications that rely heavily on Inputmask and may share objects with other logical components.