Prototype Pollution in deep-setter
Summary
GHSA-9qrg-h9g8-c65q: Prototype Pollution in deep-setter. Affects deep-setter versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The deep-setter package is an npm package that allows users to modify an object's properties deeply. It provides a convenient way to set nested properties in JavaScript objects. However, all versions of deep-setter are vulnerable to prototype pollution. This means that the package does not restrict the modification of an object's prototype, allowing an attacker to add or modify existing properties that will exist on all objects.
Vulnerability Detail
Prototype pollution is a vulnerability that occurs when an attacker can inject properties into an object's prototype. This can lead to various security issues, such as remote code execution, denial of service, or data tampering. In the case of deep-setter, an attacker could exploit this vulnerability to add or modify properties on all objects, potentially leading to unexpected behavior or security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, the best workaround is to use an alternative package that does not suffer from prototype pollution. Here is an example of how you can use the lodash.set function as an alternative to deep-setter:
const _ = require('lodash');
const obj = {};
_.set(obj, 'nested.property', 'value');
console.log(obj);
By using lodash.set, you can safely set nested properties without the risk of prototype pollution.
Conclusion
Prototype pollution in the deep-setter package is a serious vulnerability that can lead to unexpected behavior or security breaches. It is recommended to use an alternative package and keep an eye on official updates for a fix. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for deep-setter →
FAQ
Prototype pollution is a vulnerability that allows an attacker to inject properties into an object's prototype, leading to potential security issues.
Prototype pollution can result in various security issues, including remote code execution, denial of service, or data tampering.
The deep-setter package does not restrict the modification of an object's prototype, allowing an attacker to add or modify properties that will exist on all objects.
Currently, there is no fix available for the deep-setter package. It is recommended to use an alternative package until a fix is made available.
One alternative package to deep-setter is lodash.set. It provides a safe way to set nested properties without the risk of prototype pollution.
