Executive brief
The deep-set library is a utility used by Node.js and JavaScript applications to set nested properties in objects. A prototype pollution flaw allows attackers to inject malicious properties into the base JavaScript object prototype without proper validation, potentially corrupting application state, bypassing security checks, or enabling denial of service attacks.
Technical details
The vulnerability is a prototype pollution (CWE-1321) in the deepSet() function, which fails to validate or sanitize property names before assignment. An attacker can craft a path like '__proto__.isAdmin' to pollute the Object prototype, affecting all objects in the application. The vulnerability requires no authentication or user interaction and is exploitable over the network if the application exposes the deep-set function to untrusted input. Affected versions 1.0.0 through 1.0.1 lack proper checks; attackers can achieve denial of service or potentially remote code execution depending on application context.
Affected products
- <UNKNOWN> deep-set 1.0.0 through 1.0.1
Timeline
- 2020-12-29: disclosed: CVE-2020-28276 published by NVD
- 2022-05-24: advisory: GHSA-wgxm-rg53-h2c6 published
- 2020-10-29: other: Repository archived by owner on GitHub