set-deep-prop Prototype Pollution

Description

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.0

References

• GHSA-v42q-78w8-8fcc
• security.snyk.io
• CVE-2021-23373
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276
• Prototype Pollution in record-like-deep-assign - CVE-2021-23402
• Prototype Pollution in cookiex/deep - CVE-2021-23442
• Prototype Pollution in deep-get-set - deep-get-set - CVE-2020-7715

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

set-deep-prop