8.2
CVE-2024-21529
- EPSS 0.61%
- Veröffentlicht 11.09.2024 05:15:02
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle report@snyk.io
- CVE-Watchlists
- Unerledigt
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellerdset_project
≫
Produkt
dset
Default Statusunknown
Version
0
Version <
3.1.4
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.61% | 0.445 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| report@snyk.io | 8.2 | 3.9 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
|
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa
https://security.snyk.io/vuln/SNYK-JS-DSET-7116691