Approved changes feed: RSS · Atom
cpe:2.3:a:set-in_project:set-in:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Set In Project (a9a96623-737a-5ff4-80de-01a23cc7e52e) |
|---|---|
| Product | Set In (3ff5ad72-6bb7-5136-9f46-0c0263eb052f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ahdinosaur/set-in |
purl2cpe | 2026-06-01 10:13:30.956665 |
pkg:npm/set-in |
purl2cpe | 2026-06-01 10:13:30.956667 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26021 |
vulnerable | 2026-06-08 07:53:20.733853 |
Prototype pollution in set-in
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
Published: 2026-02-11T21:18:50.084Z
Updated: 2026-02-12T21:16:04.618Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25354 |
vulnerable | 2026-06-08 05:41:45.771197 |
Prototype Pollution
HIGH (8.6)
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
Published: 2022-03-17T11:20:56.621Z
Updated: 2024-09-16T17:14:02.822Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28273 |
vulnerable | 2026-06-08 05:23:53.958929 |
Details available
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
Published: 2020-12-02T14:34:07.000Z
Updated: 2024-08-04T16:33:58.176Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.