VDB
Sign up
CRITICAL9.8

GHSA-4g88-fppr-53pp

Prototype Pollution in set-value

Quick fix

GHSA-4g88-fppr-53pp — set-value: upgrade to the fixed version with the command below.

npm install set-value@2.0.1

Details

Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

## Recommendation

If you are using `set-value` 3.x, upgrade to version 3.0.1 or later. If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/set-value
Introduced in: 0Fixed in: 2.0.1
Fixnpm install set-value@2.0.1
npm/set-value
Introduced in: 3.0.0Fixed in: 3.0.1
Fixnpm install set-value@3.0.1

References