Skip to content
Sign in
6.5 Medium

CVE-2022-25645 All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks…

Description

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

Affected products and versions

Product Affected versions Fixed in
dset Versions not published

Other CVEs of dset

The 3 CVEs of dset →
CVE-2024-21529 Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper… 8.2 High CVE-2020-28277 Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service… Not rated
Track this CVE