Possible fix(deps): 78 vulnerable dependencies in package-lock.json

[begininvoke]

Spotted what might be an issue in client/package-lock.json around line 10445.

The project uses loader-utils 2.0.2, which contains CVE‑2022‑37601 – a prototype‑pollution flaw in parseQuery.js. An attacker can supply a crafted query string (e.g., ?__proto__=malicious) that mutates Object.prototype, affecting all objects in the application and potentially enabling arbitrary code execution or denial‑of‑service. Because the vulnerability is exploitable via any request that reaches the loader, it is classified as CRITICAL.

Something like this might fix it:

*** Begin Patch
*** Update File: node_modules/loader-utils/lib/parseQuery.js
@@
-function parseQuery(query) {
-  var result = {};
-  if (!query) return result;
-
-  // Trim leading ?, #, or &
-  query = query.replace(/^([?#&])/, '');
-
-  query.split('&').forEach(function (pair) {
-    var parts = pair.split('=');
-    var key = decodeURIComponent(parts.shift());
-    var value = parts.length ? decodeURIComponent(parts.join('=')) : true;
-
-    if (key) {
-      result[key] = value;
-    }
-  });
-
-  return result;
-}
+function parseQuery(query) {
+  // Use a null‑prototype object to prevent prototype pollution (CVE‑2022‑37601)
+  var result = Object.create(null);
+  if (!query) return result;
+
+  // Trim leading ?, #, or &
+  query = query.replace(/^([?#&])/, '');
+
+  query.split('&').forEach(function (pair) {
+    var parts = pair.split('=');
+    var key = decodeURIComponent(parts.shift());
+    var value = parts.length ? decodeURIComponent(parts.join('=')) : true;
+
+    // Reject keys that could pollute the prototype chain
+    if (!key || key === '__proto__' || key === 'prototype' || key === 'constructor') {
+      return;
+    }
+
+    // Safe assignment – result has no prototype, so direct property set is safe
+    result[key] = value;
+  });
+
+  return result;
+}
*** End Patch

For reference: rule CVE-2022-37601. Rated critical.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.