Prototype Pollution Vulnerability in node-set-value Package
Summary
CVE-2019-10747: set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. Affects node-set-value across 2 version ranges.
< 0.4.0-2
< bb0f0382f7d7637f3de1bba52d1b4abdbbbde4d4
Fixed in 0.4.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-set-value package is a utility for setting values on objects in JavaScript. It is commonly used in various applications to manipulate object properties dynamically. However, certain versions of this package are vulnerable to a prototype pollution issue, which can lead to unintended modifications of the Object.prototype, potentially compromising application integrity and security.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10747, arises from the mixin-deep function within the node-set-value package. This function can be exploited to add or modify properties of Object.prototype using specially crafted payloads. If an attacker successfully exploits this vulnerability, they can manipulate the behavior of the application, leading to severe consequences such as data corruption or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0.4.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-set-valueTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to sanitize any user inputs that may be passed to the mixin-deep function. This can help mitigate the risk of prototype pollution until a proper upgrade can be performed.
Conclusion
The CVE-2019-10747 vulnerability in the node-set-value package poses a significant risk due to its potential for prototype pollution. It is crucial for developers to upgrade to the fixed version and implement necessary precautions to safeguard their applications against exploitation.
See every vulnerability recorded for node-set-value →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, which can lead to unexpected behavior in applications.
Versions of node-set-value lower than 3.0.1 are vulnerable to this issue.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to data corruption, unauthorized access, and manipulation of application behavior, posing significant security risks.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software by using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for node-set-value.
