Prototype pollution vulnerability in 'deep-set

Description

The NPM module ‘deep-set’ can be abused by Prototype Pollution vulnerability since the function deepSet() does not check for the type of object before assigning value to the property.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 1.0.0, <= 1.0.1

References

• GHSA-wgxm-rg53-h2c6
• web.archive.org
• CVE-2020-28276
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in deep-get-set - deep-get-set - CVE-2020-7715
• @75lb/deep-merge Prototype Pollution vulnerability - CVE-2024-38986
• Prototype Pollution in lodash - lodash.set - CVE-2020-8203
• Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

deep-set