Description
A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
Recommendation
Update the set-in package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.1, < 2.0.5
- Patched version(s): 2.0.5
References
Could your website be exposed too?
SmartScanner can check your website for set-in Affected by Prototype Pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution in set-in - CVE-2022-25354
- Prototype pollution in set-in - set-in - CVE-2020-28273
- Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
- seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
You might also like:
See something that needs correcting? Let us knowUpdated February 12, 2026