Prototype Pollution in set-value
Summary
Prototype Pollution in set-value
Original description
The description as published by the source.
Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.
Recommendation
If you are using set-value 3.x, upgrade to version 3.0.1 or later.
If you are using set-value 2.x, upgrade to version 2.0.1 or later.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-10747 node-set-value Fixed in: 0.4.0-2
References
- advisory nvd.nist.gov
- web github.com
- web github.com
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web snyk.io
- web npmjs.com