This vulnerability in RubyLouvre avalon (versions 2.2.0 through 2.2.10) allows an attacker to remotely manipulate object prototype attributes improperly via the Template Filter Handler component's code in src/filters/index.js. The exact function affected is unspecified. Such prototype pollution can lead to unexpected behavior or security issues in applications using the affected versions. The vulnerability has been publicly disclosed, but no vendor response or patch has been provided to date.

An attacker can remotely exploit this vulnerability to modify object prototype attributes, potentially leading to altered application behavior or security bypasses. The CVSS 4.0 base score of 6.9 indicates a medium severity impact with no required privileges or user interaction, and low attack complexity. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying workarounds such as restricting access to vulnerable components or employing runtime protections against prototype pollution until an official fix is released.