The extend function in WebAudioRecorder.js accepts dynamic configuration data without proper validation, leading to unsafe modification of JavaScript object prototypes. This prototype pollution flaw, identified as CWE‑1321, can also allow insertion of executable code through malformed inputs, corresponding to CWE‑94. The primary impact is that an attacker can alter core objects, which may enable remote code execution or cause unpredictable application behavior. The vulnerable code resides in the lib/WebAudioRecorder.js function extend in higuma web-audio-recorder-js version 0.1/0.1.1.

Higuma WebAudioRecorder.js, versions 0.1 and 0.1.1, are the only releases that contain the vulnerable extend function. Any web application that imports these specific versions—via npm, CDNs, or direct script tags—is potentially exposed. The vulnerability is tied to the library's core JavaScript, and does not propagate to unrelated modules unless they invoke the extend function.

The CVSS score of 2.3 classifies this as a low‑severity vulnerability, which is reinforced by the EPSS score of less than 1 %, indicating a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, suggesting no known large‑scale attacks based on this flaw have been observed. Attackers could launch the exploit from a remote malicious web page that loads the vulnerable library and supplies crafted configuration data. While the exploit is publicly available, the complexity of dynamically traversing the library's prototype chain makes successful attacks non‑trivial, keeping the overall risk low but not negligible.