Junglewise Threat Intelligence

CVE-2026-26021: set-in prototype pollution

CVE-2026-26021 · Severity: medium · CVSS 4 · Published 2026-02-11

Technologies: set-in (npm). Vendors: npm.

Executive brief

The set-in npm package, used to manipulate JavaScript objects, contains a flaw that allows attackers to inject malicious properties into the core JavaScript Object prototype. An attacker can exploit this by crafting inputs that override built-in protection checks, potentially leading to unauthorized access, service disruption, or code execution in any application using this library with untrusted input. The vulnerability affects versions 2.0.1 through 2.0.4.

Technical details

This is a prototype pollution vulnerability in set-in caused by an inadequate check on forbidden keys. The vulnerable code at line 28 uses Array.prototype.includes() to validate whether user-supplied path keys are dangerous (e.g., "constructor", "__proto__"). An attacker can bypass this by overriding Array.prototype.includes to return false, allowing the forbidden key check to pass while still polluting Object.prototype. The attack requires only the ability to supply a crafted path array to the setIn() function; no authentication or user interaction is needed. Successful exploitation allows injection of arbitrary properties into Object.prototype, potentially leading to authentication bypass (if auth logic relies on property checks), denial of service (if the polluted properties cause exceptions), or remote code execution (if the polluted properties flow to dangerous sinks like eval or child_process.spawn). The fix in version 2.0.5 likely uses a more robust method to check forbidden keys that cannot be bypassed via prototype manipulation.

Affected products

  • ahdinosaur set-in >=2.0.1, <2.0.5

Timeline

  • 2026-02-11: disclosed: GHSA-2c4m-g7rx-63q7 published
  • 2026-02-11: patched: Fixed in version 2.0.5

References

Related threats