All the vulnerabilities related to the version 1.1.0 of the package
Prototype pollution in aurelia-path
The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will be Aurelia applications that employ the aurelia-router package. An example is this could allow an attacker to change the prototype of base object class Object by tricking an application to parse the following URL: https://aurelia.io/blog/?__proto__[asdf]=asdf
The problem should be patched in version 1.1.7. Any version earlier than this is vulnerable.
A partial work around is to free the Object prototype:
Object.freeze(Object.prototype)