The vulnerability in 1024bit extend-deep up to version 0.1.6 arises from improper handling of the __proto__ argument in an unknown function in index.js, leading to uncontrolled modification of object prototype attributes. This can be remotely exploited without authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The CVSS 4.0 base score is 6.9, reflecting medium severity with low complexity and no privileges required. The project is no longer actively maintained, and no official remediation or patch is available.

Successful exploitation could allow remote attackers to manipulate object prototype attributes, potentially leading to unexpected behavior or security issues in applications using the vulnerable package. The impact is rated medium severity with limited scope and impact as per the CVSS 4.0 score of 6.9. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the code repository has been inactive for years and no official fix is available, users should consider removing or replacing the vulnerable package or implementing application-level mitigations to prevent prototype pollution. Monitor for updates from the vendor or community for any future patches or workarounds.