Executive brief
set-getter is a JavaScript utility library used to dynamically access and modify nested object properties. A prototype pollution vulnerability in version 0.1.0 allows an attacker to inject arbitrary properties into JavaScript objects, leading to potential code execution or denial of service across applications that depend on this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in set-getter version 0.1.0 where the library fails to properly validate object keys before using them to set properties. An attacker can craft malicious input with keys like "__proto__" or "constructor.prototype" to pollute the Object prototype, affecting all objects in the application. No authentication or user interaction is required; exploitation can occur through network-accessible code that processes untrusted data via set-getter. The impact includes denial of service and potentially remote code execution depending on how the polluted properties are used. The fix was released in version 0.1.1, which filters out invalid keys to prevent prototype pollution.
Affected products
- doowb set-getter 0.1.0 and earlier
Timeline
- 2021-06-10: disclosed: CVE-2021-25949 published by NVD
- 2021-06-21: advisory: GHSA-jv35-xqg7-f92r published
- 2021: patched: Fixed in version 0.1.1 with key validation