Critical Prototype Pollution Vulnerability in set-in Package
Summary
GHSA-2c4m-g7rx-63q7: set-in Affected by Prototype Pollution. Affects set-in versions >= 2.0.1, < 2.0.5. Fixed in 2.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The set-in package is an npm library that allows users to set values in an object at a specified path. It is commonly used in JavaScript applications to manipulate nested objects easily. However, it has been found to be vulnerable to prototype pollution, which can lead to severe security risks if exploited.
Vulnerability Detail
A prototype pollution vulnerability exists in the set-in package (versions >=2.0.1 and <2.0.5). Despite previous attempts to mitigate this issue by checking for forbidden keys in user input, attackers can still exploit the vulnerability using crafted input via Array.prototype. This can lead to the pollution of Object.prototype, allowing attackers to add or modify properties on all objects. The vulnerability is located in line 28 of the index.js file, where the includes() function is used incorrectly. The potential ramifications include authentication bypass, denial of service, and even remote code execution if polluted properties are used in unsafe contexts.
How To Fix
Latest published version: 2.0.5 as of 23 Oct 2026
npm install set-in@2.0.5The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can override the Array.prototype.includes method to return false, which may prevent the pollution from occurring. However, this is not a recommended long-term solution. Here is an example code snippet:
Array.prototype.includes = () => false;
const si = require('set-in');
const obj = {};
console.log({}.polluted);
si(obj, [
'constructor',
'prototype',
'polluted'
], 'yes');
console.log('{ ' + obj.polluted + ', ' + 'yes' + ' }'); // prints yes -> indicating that the patch was bypassed and prototype pollution occurred
Conclusion
The set-in package has a critical prototype pollution vulnerability that can lead to significant security risks. It is essential to update to the patched version (2.0.5 or later) to mitigate these risks. For ongoing monitoring, consider using Vulert to stay informed about vulnerabilities in your dependencies.
See every vulnerability recorded for set-in →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to inject properties into an object's prototype, affecting all instances of that object.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
The risks include authentication bypass, denial of service, and potential remote code execution, which can lead to severe security breaches.
You can update the set-in package by running the command 'npm install set-in@2.0.5' in your terminal to ensure you have the patched version.
If you cannot update the package right away, consider implementing the temporary workaround of overriding the Array.prototype.includes method, but be aware that this is not a long-term solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for set-in.
