Prototype Pollution in set-in

Description

The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-28273

Recommendation

Update the set-in package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.3
• Patched version(s): 2.0.3

References

• GHSA-6956-83fg-5wc5
• snyk.io
• CVE-2022-25354
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in deep-get-set - CVE-2022-21231
• set-in Affected by Prototype Pollution - CVE-2026-26021
• Prototype pollution in set-in - set-in - CVE-2020-28273
• json-pointer vulnerable to Prototype Pollution - CVE-2022-4742

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

set-in