GHSA-23wx-cgxq-vpwx

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-23wx-cgxq-vpwx/GHSA-23wx-cgxq-vpwx.json
Aliases
  • CVE-2022-25645
Published
2022-05-03T00:00:45Z
Modified
2023-04-11T01:32:17.520203Z
Details

All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

References

Affected packages

npm / dset

Source Details

Package Name
dset

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
3.1.2

Maven / org.webjars.npm:dset

Source Details

Package Name
org.webjars.npm:dset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
3.1.2

Affected versions

3.*

3.0.0
3.1.0
3.1.1