# CVE-2021-23440: set-value prototype pollution with non-string path components

Source: https://junglewise.ai/threats/cve-2021-23440-set-value-prototype-pollution-with-non-string-path-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23440 · Severity: low · CVSS 3.1 · Published 2021-09-13

The set-value library is a widely-used Node.js utility for setting nested properties on objects using dot-notation syntax. A type confusion flaw allows attackers to bypass prototype pollution protections by passing array values as path components instead of strings. Successful exploitation can lead to unauthorized modification of object properties, affecting application logic, data integrity, and potentially enabling remote code execution in vulnerable deployments.

Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2021-23440 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23440 being exploited in the wild.

**How severe is CVE-2021-23440?** Low severity, with a CVSS score of 3.1, published 13 September 2021.

**Which products and versions are affected?** set-value-nuget (NuGet) 0 to 1.x.

**Is there a fix for CVE-2021-23440?** A patch was published on 2021-09-12: Patches released for set-value: 4.0.1, 3.0.3, 2.0.1 and set-value-nuget 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23440 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23440?** Check whether you run set-value-nuget (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a prototype pollution vulnerability in set-value (CVE-2021-23440) that exploits a type confusion weakness. The vulnerability occurs when user-supplied keys in the path parameter are non-string types (such as arrays), which bypass the unsafe key validation that was added in CVE-2019-10747. An attacker can craft input with array-typed path components to pollute the Object prototype or other sensitive properties. The vulnerability affects versions 0.x through 2.0.0 (npm), 3.0.0 through 3.0.2 (npm), and 4.0.0 (npm), as well as set-value-nuget versions prior to 2.0.0. Patches were released as version 4.0.1 (npm), 3.0.3 (npm), 2.0.1 (npm), and 2.0.0 (NuGet). No authentication is required and the attack is network-accessible in applications that expose set-value functionality via user input.

## Affected products

- jonschlinkert set-value 0.0.0 to 2.0.0, 3.0.0 to 3.0.2, 4.0.0
- NuGet set-value-nuget 0 to 1.x

## Identifiers

- CVE-2021-23440
- GHSA-4jqc-8m5r-9rpr

## Timeline

- 2021-09-12: disclosed: Vulnerability reported and disclosed via GitHub advisory GHSA-4jqc-8m5r-9rpr
- 2021-09-12: patched: Patches released for set-value: 4.0.1, 3.0.3, 2.0.1 and set-value-nuget 2.0.0
- 2021-09-13: advisory: OSV and GitHub advisory published

## References

- [https://github.com/jonschlinkert/set-value/pull/33](https://github.com/jonschlinkert/set-value/pull/33)
- [https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a](https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a)
- [https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245](https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245)
- [https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452](https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452)
- [https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad](https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad)
- [https://github.com/jonschlinkert/set-value](https://github.com/jonschlinkert/set-value)