This vulnerability affects the extendDefaults, extendDefinitions, and extendAliases functions within the lib/dependencyLibs/extend.js file of RobinHerbots Inputmask up to version 5.0.9. The flaw allows an attacker to manipulate object prototype attributes improperly, potentially leading to prototype pollution. The vulnerability can be triggered remotely and does not require user interaction, but does require low privileges. The project was notified early but has not yet responded or issued a patch. No known exploits are reported in the wild.

Successful exploitation may allow an attacker to modify object prototype attributes, which can lead to unexpected behavior or security issues in applications using the affected library. The CVSS 5.3 score reflects a medium impact with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released, users should monitor the vendor's communications for updates. Until a patch is available, consider avoiding use of affected versions or applying custom mitigations if feasible.