CVE-2019-10747: Prototype Pollution in set-value
Summary
CVE-2019-10747: Prototype Pollution in set-value. Affects set-value across 2 version ranges.
< 2.0.1
>= 3.0.0, < 3.0.1
Fixed in 2.0.1 or 3.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- node-set-value · Debian:11
The same CVE-2019-10747 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The set-value package is an npm package that provides a function called set for updating object properties. It is commonly used in JavaScript applications to modify object properties dynamically. However, versions prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an application does not properly validate and sanitize user input before updating object prototypes. In the case of set-value, the set function fails to validate which object properties it updates, allowing attackers to modify the prototype of the Object and add or modify existing properties on all objects. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.12.0.1npm install set-value@2.0.1 -
>= 3.0.0, < 3.0.13.0.1npm install set-value@3.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions of set-value to mitigate the risk.
Conclusion
The set-value package is vulnerable to Prototype Pollution, which can have severe security implications. It is crucial to upgrade to the fixed versions of set-value to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for set-value →
FAQ
Prototype Pollution is a vulnerability that allows attackers to modify the prototype of an object, leading to potential security issues.
This vulnerability can lead to various security issues, including remote code execution, information disclosure, or denial of service.
Versions prior to 3.0.1 or 2.0.1 of set-value are vulnerable to this issue.
To fix this vulnerability, upgrade to version 3.0.1 or later if you are using set-value 3.x, or upgrade to version 2.0.1 or later if you are using set-value 2.x.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of set-value.
References
Related vulnerabilities
Recent vulnerabilities recorded for set-value.
