Prototype Pollution in set-or-get

Description

Prototype pollution vulnerability in ‘set-or-get’ version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.

Recommendation

Update the set-or-get package to the latest compatible version. Followings are version details:

Affected version(s): >= 1.0.0, < 1.2.11
Patched version(s): 1.2.11

References

GHSA-6rv4-4qv6-88g2
www.npmjs.com
www.whitesourcesoftware.com
CVE-2021-25913
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Prototype Pollution in set-or-get and gives you actionable findings to investigate.

Start a free scan

Related Issues

Prototype Pollution in deep-get-set - deep-get-set - CVE-2020-7715
Prototype Pollution in deep-get-set - CVE-2022-21231
set-deep-prop Prototype Pollution - CVE-2021-23373
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 01, 2023