CRITICAL9.8

GHSA-qr4p-c9wr-phr6

Prototype pollution in set-in

Quick fix

GHSA-qr4p-c9wr-phr6 — set-in: upgrade to the fixed version with the command below.

npm install set-in@2.0.1

Details

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/set-in

Introduced in: 0Fixed in: 2.0.1

Fixnpm install set-in@2.0.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-28273[ADVISORY]
https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88[WEB]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273[WEB]