GHSA-3hw5-q855-g6cw

Prototype Pollution in Dojox

The Dojox jQuery wrapper `jqMix` mixin method is vulnerable to Prototype Pollution. Affected Area: ``` //https://github.com/dojo/dojox/blob/master/jq.js#L442 var tobj = {}; for(var x in props){ // the "tobj" condition avoid copying properties in "props" // inherited from Object.prototype. For example, if obj has a custom // toString() method, don't overwrite it with the toString() method // that props inherited from Object.prototype if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){ if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){ if(dojo.isArray(props[x])){ obj[x] = props[x]; }else{ obj[x] = jqMix(obj[x], props[x]); } }else{ obj[x] = props[x]; } ```