https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:06:28.363205+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-165547 EUVD-2026-165547 2026-10-10T18:06:28.365792+00:00 EUVD-2026-165547 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23460 fkie_cve-2021-23460 2026-10-10T18:06:28.365824+00:00

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

 https://cve.radiocsirt.org/vuln/ghsa-2m53-83f3-562j GHSA-2m53-83f3-562j — Prototype pollution in min-dash 2026-10-10T18:06:28.365854+00:00

Affected: npm: min-dash, Maven: org.webjars.npm:min-dash

### Impact

The `set` method is vulnerable to prototype pollution with specially crafted inputs.

```javascript // insert the following into poc.js and run node poc,js (after installing the package) let parser = require("min-dash"); parser.set({}, [["__proto__"], "polluted"], "success"); console.log(polluted); ```

### Patches

`min-dash>=3.8.1` fix the issue.

### Workarounds

No workarounds exist for the issue.

### References

Closed via https://github.com/bpmn-io/min-dash/pull/21.

### Credits

Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.

 https://cve.radiocsirt.org/vuln/gsd-2021-23460 gsd-2021-23460 2026-10-10T18:06:28.365890+00:00 gsd-2021-23460