CVE-2021-23497: Prototype Pollution in @strikeentco/set
Summary
CVE-2021-23497: Prototype Pollution in @strikeentco/set. Affects @strikeentco/set versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @strikeentco/set is an npm package that provides a set data structure implementation. It is used to store a collection of unique values and perform set operations such as union, intersection, and difference. The package is widely used in JavaScript applications for managing sets of data. However, versions before 1.0.2 are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in @strikeentco/set before 1.0.2 is due to an incomplete fix. It allows an attacker to perform prototype pollution, which can lead to a denial of service and potentially remote code execution. Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object and introduce malicious properties or methods. In this case, an attacker can manipulate the set data structure and potentially execute arbitrary code on the target system.
How To Fix
Latest published version: 1.0.2 as of 23 Oct 2026
npm install @strikeentco/set@1.0.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package to mitigate the risk of exploitation.
Conclusion
The vulnerability in @strikeentco/set before version 1.0.2 allows for prototype pollution, which can result in a denial of service and potential remote code execution. To mitigate this risk, it is crucial to update the package to version 1.0.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @strikeentco/set →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object and introduce malicious properties or methods. It can lead to various security issues, including remote code execution.
The vulnerability in @strikeentco/set allows an attacker to perform prototype pollution, potentially leading to a denial of service and remote code execution.
Yes, the vulnerability can be fixed by updating the @strikeentco/set package to version 1.0.2 or later.
No, there are no known workarounds for this vulnerability. It is essential to update to the fixed version of the package.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-39qv-prmh-x37f/GHSA-39qv-prmh-x37f.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @strikeentco/set.
