The vulnerability in RobinHerbots Inputmask (up to 5.0.9) involves the internal deep merge helper component, specifically the functions extendDefaults, extendDefinitions, and extendAliases in lib/dependencyLibs/extend.js. These functions allow an attacker to manipulate object prototype attributes improperly, potentially leading to prototype pollution. The vulnerability can be exploited remotely without user interaction and requires low privileges. The project has been informed but has not issued a response or fix. No known exploits are reported in the wild.

The vulnerability allows an attacker to perform prototype pollution by manipulating object prototype attributes. This can lead to unexpected behavior in applications using the affected library, potentially enabling further attacks or bypassing security controls. The impact is considered moderate due to the nature of the vulnerability and the lack of known exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, consider avoiding use of affected versions or implementing application-level mitigations to prevent prototype pollution.