Executive brief
dset is a popular JavaScript utility library used to safely set nested object properties. A prototype pollution vulnerability in versions before 3.1.4 allows attackers to inject malicious properties into the shared Object prototype, potentially affecting all objects and functions throughout an application. This could enable unauthorized modification of application behavior, data manipulation, or service disruption across the entire system.
Technical details
dset versions before 3.1.4 are vulnerable to prototype pollution via the dset function due to improper sanitization of user input. The vulnerability allows attackers to inject malicious properties using the __proto__ built-in Object property, which are recursively assigned to all objects in the program (CWE-1321). The attack requires network access but no authentication or user interaction; an attacker can supply a crafted key string containing __proto__ to trigger the vulnerability. This enables injection of arbitrary properties into the shared prototype chain, potentially allowing arbitrary object property manipulation across all application instances. A patch is available in version 3.1.4.
Affected products
- Luke Edwards dset before 3.1.4
Timeline
- 2024-09-11: disclosed
- 2024-09-11: patched: version 3.1.4 released