p PatchFirst

CVE-2022-25354

CVE-2022-25354 · Prototype Pollution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)

CVSS 8.6 · High · EPSS 1.9% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • set-in

    Versions
    • ≥ unspecified, < 2.0.3: Affected (custom)

    Update to 2.0.3

  • set-in npm

    Affected ranges
    • SEMVER: < 2.0.3

    Update to 2.0.3

Original sources

Check your server →