lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.
CVSS 3.1MEDIUM 5.3·Network·No auth·No interaction·EPSS 0.01041·Published 2020-12-11·Fixed in 3.2.3CWE-94