Type Confusion Vulnerability in node-set-value Package
Summary
DEBIAN-CVE-2021-23440: This affects the package set-value before =3.0.0. Affects node-set-value versions < 3.0.1-2+deb11u1. Fixed in 3.0.1-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-set-value package is a utility for setting values in objects and arrays in JavaScript. It is widely used in various applications to manipulate data structures efficiently. However, certain versions of this package are vulnerable to a type confusion issue that can lead to security risks, particularly when user-provided keys are used in the path parameter.
Vulnerability Detail
This vulnerability affects the node-set-value package versions prior to 2.0.1 and those in the range of 3.0.0 to 4.0.1. It arises from a type confusion flaw that can allow attackers to bypass the protections established by CVE-2019-10747. Specifically, when user-defined keys are utilized in the path parameter as arrays, it can lead to unintended behavior, potentially compromising the integrity of the application.
How To Fix
Minimum fixed version
3.0.1-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-set-valueTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider validating user inputs to ensure that keys are not arrays or implementing additional checks to mitigate the risk of type confusion.
Conclusion
The node-set-value package has a critical type confusion vulnerability that can lead to security risks in applications. It is crucial for developers to update to the patched versions to mitigate these risks and ensure the integrity of their applications.
See every vulnerability recorded for node-set-value →
FAQ
The node-set-value package is a JavaScript utility that allows developers to set values in objects and arrays, making data manipulation easier.
Versions of node-set-value prior to 2.0.1 and those between 3.0.0 and 4.0.1 are affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized access or manipulation of data within applications that utilize the affected package.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-set-value.
