Executive brief
set-in is a JavaScript utility library for setting nested object properties. A prototype pollution vulnerability in its setIn method allows attackers to inject malicious properties into JavaScript object prototypes, potentially affecting all objects in an application and leading to arbitrary code execution or application malfunction.
Technical details
The vulnerability is a prototype pollution flaw in the setIn method of the set-in package (CWE-1321). An attacker can craft malicious input containing prototype chain properties (e.g., "__proto__", "constructor", "prototype") that the setIn method fails to properly sanitize, allowing injection of arbitrary properties into Object.prototype. The vulnerability is network-accessible with no authentication or user interaction required. Successful exploitation enables arbitrary code execution through polluted prototype properties. The fix was released in version 2.0.3; this vulnerability represents an incomplete fix of an earlier CVE-2020-28273.
Affected products
- npm set-in before 2.0.3
Timeline
- 2022-03-18: disclosed
- 2022-03-17: advisory: NVD published
- 2022-03-18: patched: fix released in version 2.0.3