GHSA-39qv-prmh-x37f

Prototype Pollution in @strikeentco/set

Source: GitHub Advisory Database (reviewed) High CVE-2021-23497

Packages

Ecosystem	Package	Affected	Fixed in
npm	@strikeentco/set	< 1.0.2	1.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23497 advisory
https://github.com/strikeentco/set/commit/b2f942c web
https://github.com/strikeentco/set web
https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821 web
https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation web
https://snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-2385945 web