EUVD-2026-165547

fkie_cve-2021-23460

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

GHSA-2m53-83f3-562j — Prototype pollution in min-dash

Affected: npm: min-dash, Maven: org.webjars.npm:min-dash

### Impact

The `set` method is vulnerable to prototype pollution with specially crafted inputs.

```javascript // insert the following into poc.js and run node poc,js (after installing the package) let parser = require("min-dash"); parser.set({}, [["__proto__"], "polluted"], "success"); console.log(polluted); ```

### Patches

`min-dash>=3.8.1` fix the issue.

### Workarounds

No workarounds exist for the issue.

### References

Closed via https://github.com/bpmn-io/min-dash/pull/21.

### Credits

Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.

Most recent entries from all

EUVD-2026-165547

fkie_cve-2021-23460

GHSA-2m53-83f3-562j — Prototype pollution in min-dash

gsd-2021-23460