GitHub Advisoryadvisory · npm

GHSA-6956-83fg-5wc5 Prototype Pollution in set-in

CRITICAL Published 2022-03-18 Modified 2022-03-29 Official page ↗
Aliases
CVE-2022-25354
Ecosystem
npm
Packages
set-in
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-03-18

Affected packages

• npm set-in: < 2.0.3 → fixed in 2.0.3

Description

The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-28273

Related

Alias · CVE (1)

  • CVE-2022-25354 The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References