# CVE-2020-28277: dset prototype pollution

Source: https://junglewise.ai/threats/cve-2020-28277-dset-prototype-pollution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-28277 · Severity: low · CVSS 3.1 · Published 2022-05-24

dset is a popular JavaScript library for safely setting deeply nested object properties. A prototype pollution vulnerability allows attackers to modify the JavaScript Object prototype, potentially affecting all objects in an application. This could lead to denial of service, unauthorized privilege escalation, or remote code execution depending on how the affected application uses objects.

Technologies: [dset (npm)](https://junglewise.ai/threats/technologies/dset). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-28277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28277 being exploited in the wild.

**How severe is CVE-2020-28277?** Low severity, with a CVSS score of 3.1, published 24 May 2022.

**Which products and versions are affected?** dset (npm) SEMVER:introduced=1.0.0,fixed=2.0.1.

**Is there a fix for CVE-2020-28277?** Yes. dset (npm): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28277 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-28277?** Check whether you run dset (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dset (npm): upgrade to 2.0.1 or later

  ```sh
  npm install dset@2.0.1
  ```


## Technical details

dset versions 1.0.0 through 2.0.1 are vulnerable to prototype pollution (CWE-1321) in the export function, which fails to validate input before assigning values to object properties. An attacker can supply a malicious value via the keys parameter containing "__proto__" to pollute the Object prototype chain. The vulnerability requires no authentication or user interaction and is accessible via any code path that passes untrusted data to dset. Successful exploitation can cause denial of service or remote code execution. The issue was fixed in version 2.0.2.

## Affected products

- dset dset 1.0.0 through 2.0.1

## Identifiers

- CVE-2020-28277
- GHSA-q4xc-7cw8-cgfj

## Timeline

- 2020-12-29: disclosed: NVD published
- 2020: patched: Fixed in version 2.0.2
- 2022-05-24: advisory: GHSA advisory published

## References

- [https://github.com/lukeed/dset/issues/11](https://github.com/lukeed/dset/issues/11)

## Related threats

- [dset prototype pollution vulnerability](https://junglewise.ai/threats/cve-2024-21529-dset-prototype-pollution-vulnerability)
- [lukeed dset prototype pollution in merge mode](https://junglewise.ai/threats/cve-2022-25645-lukeed-dset-prototype-pollution-in-merge-mode)