medium6.5
CVE-2022-25645
Prototype Pollution in dset
Impact
All versions of `dset` prior to 3.1.2 are vulnerable to Prototype Pollution via `dset/merge` mode, as the `dset` function checks for prototype pollution by validating if the top-level path contains `__proto__`, `constructor` or `prototype`. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | dset | < 3.1.2 | 3.1.2 |
| maven | org.webjars.npm:dset | < 3.1.2 | 3.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dset Project | Dset | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/lukeed/dset/blob/master/src/merge.js%23L9
- https://github.com/lukeed/dset/pull/38
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974
- https://snyk.io/vuln/SNYK-JS-DSET-2330881
- https://github.com/advisories/GHSA-23wx-cgxq-vpwx
- https://nvd.nist.gov/vuln/detail/CVE-2022-25645