Security Issue: Prototype Pollution

[mkilpatrick]

https://nvd.nist.gov/vuln/detail/CVE-2024-57072

[mkilpatrick]

Any chance this security vulnerability will be looked into?

[jwartofsky-yext]

Bump to the above question ^

Any chance this will be fixed?

[Fidget-Grep]

Given that the latest commits on this repository happened around 10 months ago, and that recent Issues and PRs haven't been addressed, I think it's safe to say that this project is currently unmaintained. I do hope it gets picked up again, given how many people use it.
Regarding CVE-2024-57072, however, I think that is the least of your concerns. In an issue I opened back in February I outlined several serious Remote Code Execution vulnerabilities in the 3 main functions of this library, including lib.requireFromString (the function affected by this CVE). I would highly recommend switching to a more secure library, as using any of these functions in production code would be extremely dangerous.

[Fidget-Grep]

If you're looking for alternatives to load JavaScript modules from a string, I would probably recommend using the built-in Dynamic Import syntax. See this thread on StackOverflow for more details.