Description
All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
Recommendation
Update the dset package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.1.2
- Patched version(s): 3.1.2
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution in dset and gives you actionable findings to investigate.
Start a free scanRelated Issues
- steal vulnerable to Prototype Pollution via requestedVersion variable - CVE-2022-37257
- deep-object-diff vulnerable to Prototype Pollution - CVE-2022-41713
- steal vulnerable to Prototype Pollution - CVE-2022-37258
- ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution - CVE-2022-25907
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023