ahdinosaur/set-in · Security
Prototype Pollution in set-in
- GHSA ID
- GHSA-6956-83fg-5wc5
- CVE ID
- CVE-2022-25354
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-28273
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25354 ↗
- https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24 ↗
- https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f3490/index.js%23L5 ↗
- https://snyk.io/vuln/SNYK-JS-SETIN-2388571 ↗
- https://github.com/advisories/GHSA-6956-83fg-5wc5 ↗