# CVE-2022-25354: set-in prototype pollution in setIn method

Source: https://junglewise.ai/threats/cve-2022-25354-set-in-prototype-pollution-in-setin-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25354 · Severity: low · CVSS 3.1 · Published 2022-03-18

set-in is a JavaScript utility library for setting nested object properties. A prototype pollution vulnerability in its setIn method allows attackers to inject malicious properties into JavaScript object prototypes, potentially affecting all objects in an application and leading to arbitrary code execution or application malfunction.

Technologies: [set-in (npm)](https://junglewise.ai/threats/technologies/set-in). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25354 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25354 being exploited in the wild.

**How severe is CVE-2022-25354?** Low severity, with a CVSS score of 3.1, published 18 March 2022.

**Which products and versions are affected?** set-in (npm) before 2.0.3.

**Is there a fix for CVE-2022-25354?** A patch was published on 2022-03-18: fix released in version 2.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25354 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-25354?** Check whether you run set-in (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a prototype pollution flaw in the setIn method of the set-in package (CWE-1321). An attacker can craft malicious input containing prototype chain properties (e.g., "__proto__", "constructor", "prototype") that the setIn method fails to properly sanitize, allowing injection of arbitrary properties into Object.prototype. The vulnerability is network-accessible with no authentication or user interaction required. Successful exploitation enables arbitrary code execution through polluted prototype properties. The fix was released in version 2.0.3; this vulnerability represents an incomplete fix of an earlier CVE-2020-28273.

## Affected products

- npm set-in before 2.0.3

## Identifiers

- CVE-2022-25354
- GHSA-6956-83fg-5wc5

## Timeline

- 2022-03-18: disclosed
- 2022-03-17: advisory: NVD published
- 2022-03-18: patched: fix released in version 2.0.3

## References

- [https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24](https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24)

## Related threats

- [set-in prototype pollution](https://junglewise.ai/threats/cve-2026-26021-ahdinosaur-set-in-prototype-pollution-bypass)
- [set-in prototype pollution](https://junglewise.ai/threats/cve-2020-28273-set-in-prototype-pollution)