~ / search / GHSA-4jqc-8m5r-9rpr

GHSA-4jqc-8m5r-9rpr

Prototype Pollution in set-value

Source: GitHub Advisory Database (reviewed) High CVE-2021-23440

Packages

EcosystemPackageAffectedFixed in
npm set-value >= 4.0.0, < 4.0.1 4.0.1
NuGet set-value-nuget < 2.0.0 2.0.0
npm set-value < 2.0.1 2.0.1
npm set-value >= 3.0.0, < 3.0.3 3.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package `set-value`. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

References

External links from the advisory. They lead to third-party sites.