npm dset vulnerabilities

Latest npm dset CVEs

Newest publication first

1. CVE-2024-21529 dset Prototype Pollution vulnerability

   Published 2024-09-11

   High·CVSS 8.8 EPSS 0.75%

   Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively as...

2. CVE-2022-25645 Prototype Pollution

   Published 2022-05-01

   High·CVSS 8.1 EPSS 1.8%

   All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass thi...

3. CVE-2020-28277 dset vulnerable to prototype pollution

   Published 2020-12-29

   Critical·CVSS 9.8 EPSS 3.1%

   Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.