Vulnerability	Vulnerable Version
H Prototype Pollution set-value is a package that creates nested values and any intermediaries using dot notation ('a.b.c') paths. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the `path` parameter are arrays. PoC `const set = require("set-value") // set({}, ['__proto__','polluted'], 'yes'); // console.log(polluted); // Error: Cannot set unsafe key: "__proto__" set({}, [['__proto__'],'polluted'], 'yes'); console.log(polluted);` How to fix Prototype Pollution? Upgrade `set-value` to version 2.0.1, 3.0.3, 4.0.1 or higher.	<2.0.1>=3.0.0 <3.0.3>=4.0.0 <4.0.1
H Prototype Pollution set-value is a package that creates nested values and any intermediaries using dot notation ('a.b.c') paths. Affected versions of this package are vulnerable to Prototype Pollution. The function `set-value` could be tricked into adding or modifying properties of `Object.prototype` using any of the `constructor`, `prototype` and `_proto_` payloads. How to fix Prototype Pollution? Upgrade `set-value` to version 2.0.1, 3.0.1 or higher.	<2.0.1>=3.0.0 <3.0.1

Prototype Pollution

set-value is a package that creates nested values and any intermediaries using dot notation ('a.b.c') paths.

Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

PoC

const set = require("set-value")

// set({}, ['__proto__','polluted'], 'yes');
// console.log(polluted); // Error: Cannot set unsafe key: "__proto__"

set({}, [['__proto__'],'polluted'], 'yes');
console.log(polluted);

How to fix Prototype Pollution?

Upgrade set-value to version 2.0.1, 3.0.3, 4.0.1 or higher.

<2.0.1>=3.0.0 <3.0.3>=4.0.0 <4.0.1

Prototype Pollution

set-value is a package that creates nested values and any intermediaries using dot notation ('a.b.c') paths.

Affected versions of this package are vulnerable to Prototype Pollution. The function set-value could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.

How to fix Prototype Pollution?

Upgrade set-value to version 2.0.1, 3.0.1 or higher.

<2.0.1>=3.0.0 <3.0.1

Go back to all versions of this package