A flaw in the index.js file of the 1024bit extend-deep library allows an attacker to manipulate the __proto__ property of objects. This leads to prototype pollution, where malicious values can overwrite properties on JavaScript prototypes. The result can be arbitrary code execution or other damaging changes to application state. The vulnerability is classified as CWE‑1321 and involves unsafe execution paths associated with CWE‑94. The exact source of malicious payload is not disclosed, but it is inferred that an attacker could trigger the flaw remotely by sending crafted input to the vulnerable function.

The library 1024bit extend‑deep is affected, with all releases up to and including version 0.1.6. Any application that imports or uses this module without upgrading is potentially vulnerable.

The CVSS score of 6.9 indicates a moderate to high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Publicly disclosed exploits exist, and remote exploitation is possible when untrusted data flows into the vulnerable function. Attackers can likely trigger the flaw through network‑based inputs or by including malicious payloads when the library is executed in a web environment. The likely attack vector is remote via network inputs or included malicious payloads, which is inferred rather than directly stated.