CVE-2020-28281: Prototype pollution in set-object-value
Summary
CVE-2020-28281: Prototype pollution in set-object-value. Affects set-object-value versions < 0.0.6. Fixed in 0.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'set-object-value' package is an npm package that provides functionality for setting values in JavaScript objects. It is widely used in various applications and libraries. However, versions 0.0.0 through 0.0.5 of the package are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in 'set-object-value' allows an attacker to perform prototype pollution, leading to a denial of service and potential remote code execution. By manipulating the prototype of an object, an attacker can modify or add properties to all objects derived from that prototype, potentially causing unexpected behavior or even executing arbitrary code.
How To Fix
Minimum fixed version
0.0.6
This is the first release that contains the fix.
npm install set-object-value@0.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The 'set-object-value' package versions 0.0.0 through 0.0.5 are vulnerable to prototype pollution, which can result in a denial of service and potential remote code execution. It is crucial to update to version 0.0.6 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for set-object-value →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or code execution.
The vulnerability can result in a denial of service and may allow an attacker to execute arbitrary code remotely.
Versions 0.0.0 through 0.0.5 of 'set-object-value' are affected by this vulnerability.
Yes, upgrading to version 0.0.6 or later of 'set-object-value' fixes the vulnerability.
No, updating to the fixed version is the only known solution.
