CVE-2025-57323: mpregular vulnerable to prototype pollution

The vulnerability lies in the 'mpregular' package, version 0.2.0 and earlier. The core of the issue is in the 'mp.addEventHandler' function, which does not properly sanitize the 'type' argument. An attacker can craft a malicious template that, when parsed by the 'Component.prototype.$init' function, causes 'addEventHandler' to be called with 'type' as 'proto'. This leads to an attempt to call the 'push' method on 'Object.prototype', resulting in a denial-of-service. The advisory also mentions prototype pollution as a consequence, which is a plausible scenario in some JavaScript engines, although my analysis primarily confirms the DoS vector. The identified functions, 'addEventHandler' and 'Component.prototype.$init', are the key components in the execution flow of this vulnerability.