Executive brief
dset is a popular JavaScript library for safely setting deeply nested object properties. A prototype pollution vulnerability allows attackers to modify the JavaScript Object prototype, potentially affecting all objects in an application. This could lead to denial of service, unauthorized privilege escalation, or remote code execution depending on how the affected application uses objects.
Technical details
dset versions 1.0.0 through 2.0.1 are vulnerable to prototype pollution (CWE-1321) in the export function, which fails to validate input before assigning values to object properties. An attacker can supply a malicious value via the keys parameter containing "__proto__" to pollute the Object prototype chain. The vulnerability requires no authentication or user interaction and is accessible via any code path that passes untrusted data to dset. Successful exploitation can cause denial of service or remote code execution. The issue was fixed in version 2.0.2.
Affected products
- dset dset 1.0.0 through 2.0.1
Timeline
- 2020-12-29: disclosed: NVD published
- 2020: patched: Fixed in version 2.0.2
- 2022-05-24: advisory: GHSA advisory published