GHSA-23wx-cgxq-vpwx

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-23wx-cgxq-vpwx/GHSA-23wx-cgxq-vpwx.json
Aliases
  • CVE-2022-25645
Published
2022-05-03T00:00:45Z
Modified
2022-11-22T00:58:45.432761Z
Details

All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

References

Affected packages

npm / dset

dset

Affected ranges

Type
SEMVER
Events
Introduced
0
Fixed
3.1.2

Affected versions

Maven / org.webjars.npm:dset

org.webjars.npm:dset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
3.1.2

Affected versions

3.*

3.0.0
3.1.0
3.1.1