CVE-2022-25645: Prototype Pollution in dset
Summary
CVE-2022-25645: Prototype Pollution in dset. Affects dset versions < 3.1.2. Fixed in 3.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dset package is an npm package that provides a utility function for deep merging objects. It is commonly used in JavaScript applications to merge and manipulate complex data structures. The package allows developers to merge objects while preserving the prototype chain. However, versions prior to 3.1.2 are vulnerable to a prototype pollution attack.
Vulnerability Detail
The vulnerability in dset is related to prototype pollution. Prototype pollution is a type of vulnerability that allows an attacker to modify the prototype of an object, which can lead to unexpected behavior and potential security issues. In the case of dset, the dset/merge mode is affected. The package checks for prototype pollution by validating if the top-level path contains __proto__, constructor, or prototype. However, a malicious object can be crafted to bypass this check and achieve prototype pollution. This can lead to various security risks, such as unauthorized data modification or remote code execution.
How To Fix
Minimum fixed version
3.1.2
This is the first release that contains the fix.
npm install dset@3.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the dset package as soon as possible.
Conclusion
The dset package prior to version 3.1.2 is vulnerable to prototype pollution. This can lead to unauthorized data modification, unexpected behavior, and potential remote code execution. It is crucial to update to the fixed version of the package (3.1.2 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dset →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
The dset package checks for prototype pollution by validating if the top-level path contains __proto__, constructor, or prototype. However, a crafted malicious object can bypass this check and achieve prototype pollution.
Prototype pollution in dset can lead to unauthorized data modification, unexpected behavior, and even remote code execution. It is a serious security issue that should be addressed promptly.
To fix the vulnerability, update the dset package to version 3.1.2 or later. Run the command npm install dset@latest in your project directory to update the package.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version of the dset package.
References
Related vulnerabilities
Recent vulnerabilities recorded for dset.
