Prototype Pollution in keyget npm package
Summary
CVE-2020-28272: keyget vulnerable to prototype pollution. Affects keyget versions >= 1.0.0, < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The keyget npm package is a utility library that provides functions for accessing and manipulating nested properties in JavaScript objects. It allows developers to retrieve values from objects using dot notation or a path string. The package is widely used in Node.js and JavaScript applications for handling object properties. However, versions 1.0.0 through 2.2.0 of keyget are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in keyget arises from a lack of validation in the 'setByPath()' function. This function accepts three arguments: 'target', 'path', and 'value'. The issue occurs when an attacker can manipulate the 'path' argument to include the 'proto' property. As there is no validation to check whether the assigned 'path' is the object's own property or not, the 'polluted' property is directly assigned to the empty object ({}), polluting the Object prototype. This can lead to denial of service or potentially remote code execution.
How To Fix
Latest published version: 2.4.0 as of 23 Oct 2026
npm install keyget@2.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
npm install keyget@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the keyget package is not immediately feasible, developers can mitigate the vulnerability by implementing input validation and sanitization when using the 'setByPath()' function. This can involve checking the type of the 'target' object and ensuring that the 'path' argument does not include any potentially malicious properties.
Conclusion
The keyget npm package versions 1.0.0 through 2.2.0 are vulnerable to prototype pollution, which can lead to denial of service and potential remote code execution. Developers should update their keyget package to version 2.3.0 or later to fix the issue. If immediate update is not possible, implementing input validation and sanitization can help mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keyget →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can manipulate the prototype of an object, leading to unexpected behavior and potential security issues.
The impact of this vulnerability can range from denial of service to potential remote code execution. An attacker could manipulate object properties and potentially execute arbitrary code on the affected system.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to update the keyget package to the latest version to mitigate any potential risks.
No, only versions 1.0.0 through 2.2.0 of keyget are affected by this vulnerability. Developers should update to version 2.3.0 or later to fix the issue.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for keyget.
