jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

OSVersionArchitecturePackageVersionFilename
Debian10alljquery< 3.3.1~dfsg-2jquery_3.3.1~dfsg-2_all.deb
Debian12allmediawiki< 1:1.31.2-1mediawiki_1:1.31.2-1_all.deb
Debian11allmediawiki< 1:1.31.2-1mediawiki_1:1.31.2-1_all.deb
Debian10allmediawiki< 1:1.31.2-1mediawiki_1:1.31.2-1_all.deb
Debian999allmediawiki< 1:1.31.2-1mediawiki_1:1.31.2-1_all.deb
Debian13allmediawiki< 1:1.31.2-1mediawiki_1:1.31.2-1_all.deb
Debian12allnode-jquery< 2.2.4+dfsg-4node-jquery_2.2.4+dfsg-4_all.deb
Debian11allnode-jquery< 2.2.4+dfsg-4node-jquery_2.2.4+dfsg-4_all.deb
Debian10allnode-jquery< 2.2.4+dfsg-4node-jquery_2.2.4+dfsg-4_all.deb
Debian999allnode-jquery< 2.2.4+dfsg-4node-jquery_2.2.4+dfsg-4_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	jquery	< 3.3.1~dfsg-2	jquery_3.3.1~dfsg-2_all.deb
Debian	12	all	mediawiki	< 1:1.31.2-1	mediawiki_1:1.31.2-1_all.deb
Debian	11	all	mediawiki	< 1:1.31.2-1	mediawiki_1:1.31.2-1_all.deb
Debian	10	all	mediawiki	< 1:1.31.2-1	mediawiki_1:1.31.2-1_all.deb
Debian	999	all	mediawiki	< 1:1.31.2-1	mediawiki_1:1.31.2-1_all.deb
Debian	13	all	mediawiki	< 1:1.31.2-1	mediawiki_1:1.31.2-1_all.deb
Debian	12	all	node-jquery	< 2.2.4+dfsg-4	node-jquery_2.2.4+dfsg-4_all.deb
Debian	11	all	node-jquery	< 2.2.4+dfsg-4	node-jquery_2.2.4+dfsg-4_all.deb
Debian	10	all	node-jquery	< 2.2.4+dfsg-4	node-jquery_2.2.4+dfsg-4_all.deb
Debian	999	all	node-jquery	< 2.2.4+dfsg-4	node-jquery_2.2.4+dfsg-4_all.deb