Executive brief
set-in is a popular JavaScript utility library for manipulating nested object properties. A prototype pollution vulnerability in versions prior to 2.0.1 allows attackers to inject malicious properties into JavaScript object prototypes, potentially causing denial of service or remote code execution in applications that use this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the set-in library versions 1.0.0 through 2.0.0, which fails to properly sanitize user-supplied input when setting object properties. An attacker can exploit this by injecting specially crafted property names (such as "__proto__" or "constructor.prototype") to pollute the Object prototype, affecting all objects in the application. No authentication or user interaction is required; the attack is triggered through direct manipulation of the library's API with malicious input. This can lead to denial of service (application crash) or potentially remote code execution depending on how the application uses the polluted prototype. The vulnerability was patched in version 2.0.1.
Affected products
- ahdinosaur set-in 1.0.0 through 2.0.0
Timeline
- 2020-12-02: disclosed: CVE-2020-28273 published on NVD
- 2020: patched: Fix committed to repository
- 2021-03-19: advisory: GHSA-qr4p-c9wr-phr6 published