CVE-2021-23440: Prototype Pollution in set-value
Summary
CVE-2021-23440: Prototype Pollution in set-value. Affects set-value across 3 version ranges.
< 2.0.1
>= 3.0.0, < 3.0.3
>= 4.0.0, < 4.0.1
Fixed in 2.0.1, 3.0.3 or 4.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- node-set-value · Debian:11
The same CVE-2021-23440 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'set-value' is an npm package that provides a utility function for setting nested properties in JavaScript objects. It is commonly used in web applications and other JavaScript projects. The vulnerability identified as CVE-2021-23440 is a type confusion vulnerability that affects the 'set-value' package. It can lead to a bypass of CVE-2019-10747 when user-provided keys used in the path parameter are arrays.
Vulnerability Detail
The vulnerability arises due to a type confusion issue in the 'set-value' package. When user-provided keys used in the path parameter are arrays, it can result in prototype pollution. This can potentially lead to unauthorized modifications of objects and properties, allowing an attacker to execute arbitrary code or perform other malicious activities. The impact of this vulnerability is considered high, with a CVSS score of 7.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.12.0.1npm install set-value@2.0.1 -
>= 3.0.0, < 3.0.33.0.3npm install set-value@3.0.3 -
>= 4.0.0, < 4.0.14.0.1npm install set-value@4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by avoiding the use of user-provided keys as arrays in the path parameter when using the 'set-value' package.
Conclusion
The 'set-value' package is vulnerable to a type confusion issue that can lead to prototype pollution. It is recommended to update the package to version 4.0.1 or later to fix this vulnerability. Developers should also avoid using user-provided keys as arrays in the path parameter to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for set-value →
FAQ
The vulnerability can lead to unauthorized modifications of objects and properties, potentially allowing an attacker to execute arbitrary code or perform other malicious activities.
To fix this vulnerability, update the 'set-value' package to version 4.0.1 or later.
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by avoiding the use of user-provided keys as arrays in the path parameter when using the 'set-value' package.
The CVSS score of this vulnerability is 7.3.
For more information about this vulnerability, you can refer to the GitHub Advisory Database: [link to the vulnerability details]
References
Related vulnerabilities
Recent vulnerabilities recorded for set-value.
