# CVE-2022-25645: lukeed dset prototype pollution in merge mode

Source: https://junglewise.ai/threats/cve-2022-25645-lukeed-dset-prototype-pollution-in-merge-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-03. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2022-25645 · Severity: low · CVSS 3.1 · Published 2022-05-03

dset is a small utility used by developers to safely write values deep into JavaScript objects. A vulnerability in its merge mode allows an attacker to bypass security checks and modify the base structure of all objects in the application. This could lead to application crashes, unauthorized data modification, or potentially full control over the affected system.

Technologies: [dset (npm)](https://junglewise.ai/threats/technologies/dset). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25645 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25645 being exploited in the wild.

**How severe is CVE-2022-25645?** Low severity, with a CVSS score of 3.1, published 3 May 2022.

**Which products and versions are affected?** org.webjars.npm:dset (Maven) ECOSYSTEM:introduced=0,fixed=3.1.2; dset (npm) SEMVER:introduced=0,fixed=3.1.2.

**Is there a fix for CVE-2022-25645?** Yes. org.webjars.npm:dset (Maven): upgrade to 3.1.2 or later; dset (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25645 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25645?** Check whether you run org.webjars.npm:dset (Maven) or dset (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.webjars.npm:dset (Maven): upgrade to 3.1.2 or later

  ```sh
  # set org.webjars.npm:dset to 3.1.2 in your pom.xml or build.gradle
  ```

- dset (npm): upgrade to 3.1.2 or later

  ```sh
  npm install dset@3.1.2
  ```


## Technical details

The dset library is vulnerable to prototype pollution when using the 'dset/merge' functionality. The root cause is an insufficient validation check that only inspects the top-level path for sensitive keys like '__proto__', 'constructor', or 'prototype'. An attacker can bypass this check by crafting a malicious object (e.g., using JSON.parse to include specific keys) that is then recursively merged into a target object. If successful, the attacker can pollute the global Object.prototype, which may lead to Denial of Service (DoS), property injection, or Remote Code Execution (RCE) depending on the application's environment. The issue is fixed in version 3.1.2.

## Affected products

- lukeed dset < 3.1.2

## Identifiers

- CVE-2022-25645
- GHSA-23wx-cgxq-vpwx

## Timeline

- 2022-01-06: disclosed
- 2022-03-23: advisory: Snyk advisory published
- 2022-05-01: advisory: NVD published CVE-2022-25645
- 2022-05-03: advisory: GitHub GHSA published

## References

- [https://github.com/lukeed/dset](https://github.com/lukeed/dset)
- [https://github.com/lukeed/dset/blob/master/src/merge.js%23L9](https://github.com/lukeed/dset/blob/master/src/merge.js%23L9)
- [https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974)
- [https://snyk.io/vuln/SNYK-JS-DSET-2330881](https://snyk.io/vuln/SNYK-JS-DSET-2330881)

## Related threats

- [dset prototype pollution vulnerability](https://junglewise.ai/threats/cve-2024-21529-dset-prototype-pollution-vulnerability)
- [dset prototype pollution](https://junglewise.ai/threats/cve-2020-28277-dset-prototype-pollution)