fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.
{
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "3.3.1"
}
],
"cpe": "cpe:2.3:a:fun-map_project:fun-map:*:*:*:*:*:*:*:*"
}