Prototype Pollution Vulnerability in node-set-value Package
Summary
DEBIAN-CVE-2019-10747: set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. Affects node-set-value versions < 0.4.0-2. Fixed in 0.4.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-set-value package is a utility for setting values in objects, commonly used in JavaScript applications. It allows developers to easily manipulate object properties and is often integrated into larger frameworks. However, certain versions of this package are vulnerable to a security flaw that can lead to prototype pollution, potentially allowing attackers to modify the Object.prototype.
Vulnerability Detail
The vulnerability in the node-set-value package arises from its mixin-deep function, which can be exploited to add or modify properties of Object.prototype. This issue affects versions lower than 3.0.1, allowing attackers to manipulate object properties in unintended ways. The ramifications of this vulnerability can include unauthorized access to sensitive data, application crashes, or even remote code execution, depending on how the affected application utilizes the package.
How To Fix
Minimum fixed version
0.4.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-set-valueTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize any data being passed to the mixin-deep function, thereby mitigating the risk of prototype pollution.
Conclusion
The node-set-value package has a significant vulnerability related to prototype pollution in versions lower than 3.0.1. It is crucial for developers to update to the patched version to safeguard their applications. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for node-set-value →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, which can lead to unexpected behavior in applications.
Versions of node-set-value lower than 3.0.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, application crashes, and potential remote code execution.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-set-value.
