Is CVE-2020-28277 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-28277 being exploited in the wild.

How severe is CVE-2020-28277?

Low severity, with a CVSS score of 3.1, published 24 May 2022.

Which products and versions are affected?

dset (npm) SEMVER:introduced=1.0.0,fixed=2.0.1.

Is there a fix for CVE-2020-28277?

Yes. dset (npm): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-28277 attacked?

It is attacked over the network.

Am I affected by CVE-2020-28277?

Check whether you run dset (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-28277: dset prototype pollution

CVE-2020-28277 · Severity: low · CVSS 3.1 · Published 2022-05-24

dset is a popular JavaScript library for safely setting deeply nested object properties. A prototype pollution vulnerability allows attackers to modify the JavaScript Object prototype, potentially affecting all objects in an application. This could lead to denial of service, unauthorized privilege escalation, or remote code execution depending on how the affected application uses objects.

Technologies: dset (npm). Vendors: npm.

Quick answers

Is CVE-2020-28277 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-28277 being exploited in the wild.
How severe is CVE-2020-28277?: Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?: dset (npm) SEMVER:introduced=1.0.0,fixed=2.0.1.
Is there a fix for CVE-2020-28277?: Yes. dset (npm): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-28277 attacked?: It is attacked over the network.
Am I affected by CVE-2020-28277?: Check whether you run dset (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dset (npm): upgrade to 2.0.1 or later
```
npm install dset@2.0.1
```

Technical details

dset versions 1.0.0 through 2.0.1 are vulnerable to prototype pollution (CWE-1321) in the export function, which fails to validate input before assigning values to object properties. An attacker can supply a malicious value via the keys parameter containing "__proto__" to pollute the Object prototype chain. The vulnerability requires no authentication or user interaction and is accessible via any code path that passes untrusted data to dset. Successful exploitation can cause denial of service or remote code execution. The issue was fixed in version 2.0.2.

Affected products

dset dset 1.0.0 through 2.0.1

Identifiers

CVE-2020-28277
GHSA-q4xc-7cw8-cgfj

Timeline

2020-12-29: disclosed: NVD published
2020: patched: Fixed in version 2.0.2
2022-05-24: advisory: GHSA advisory published

References

https://github.com/lukeed/dset/issues/11

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.