GitHub Advisoryadvisory · npm

GHSA-4g88-fppr-53pp Prototype Pollution in set-value

CRITICAL Published 2019-08-27 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-10747
Ecosystem
npm
Packages
set-value
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2019-08-27

Affected packages

• npm set-value: < 2.0.1 → fixed in 2.0.1 • npm set-value: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. Recommendation If you are using `set-value` 3.x, upgrade to version 3.0.1 or later. If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.

Related

Alias · CVE (1)

  • CVE-2019-10747 set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References