CVE-2026-26021: set-in prototype pollution

CVE-2026-26021 · Severity: medium · CVSS 4 · Published 2026-02-11

The set-in npm package, used to manipulate JavaScript objects, contains a flaw that allows attackers to inject malicious properties into the core JavaScript Object prototype. An attacker can exploit this by crafting inputs that override built-in protection checks, potentially leading to unauthorized access, service disruption, or code execution in any application using this library with untrusted input. The vulnerability affects versions 2.0.1 through 2.0.4.

Technologies: set-in (npm). Vendors: npm.

Quick answers

Is CVE-2026-26021 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26021 being exploited in the wild.
How severe is CVE-2026-26021?
Medium severity, with a CVSS score of 4, published 11 February 2026.
Which products and versions are affected?
set-in (npm) SEMVER:introduced=2.0.1,fixed=2.0.5.
Is there a fix for CVE-2026-26021?
Yes. set-in (npm): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26021 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-26021?
Check whether you run set-in (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • set-in (npm): upgrade to 2.0.5 or later
    npm install set-in@2.0.5

Technical details

This is a prototype pollution vulnerability in set-in caused by an inadequate check on forbidden keys. The vulnerable code at line 28 uses Array.prototype.includes() to validate whether user-supplied path keys are dangerous (e.g., "constructor", "__proto__"). An attacker can bypass this by overriding Array.prototype.includes to return false, allowing the forbidden key check to pass while still polluting Object.prototype. The attack requires only the ability to supply a crafted path array to the setIn() function; no authentication or user interaction is needed. Successful exploitation allows injection of arbitrary properties into Object.prototype, potentially leading to authentication bypass (if auth logic relies on property checks), denial of service (if the polluted properties cause exceptions), or remote code execution (if the polluted properties flow to dangerous sinks like eval or child_process.spawn). The fix in version 2.0.5 likely uses a more robust method to check forbidden keys that cannot be bypassed via prototype manipulation.

Affected products

  • ahdinosaur set-in >=2.0.1, <2.0.5

Identifiers

  • CVE-2026-26021
  • GHSA-2c4m-g7rx-63q7

Timeline

  • 2026-02-11: disclosed: GHSA-2c4m-g7rx-63q7 published
  • 2026-02-11: patched: Fixed in version 2.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.