PT-2026-7723 · Set-In · Set-In
Kevgeoleo
+2
·
Publicado
2026-02-11
·
Atualizado
2026-02-15
·
CVE-2026-26021
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
set-in versions 2.0.1 through 2.0.4
Description
set-in is a Node.js package that sets values within nested associative structures given an array of keys. A flaw exists where, despite a previous attempt to prevent prototype pollution by checking for forbidden keys, it remains possible to pollute
Object.prototype using a crafted input leveraging Array.prototype. The issue resides in the includes() function used to validate user input. A proof-of-concept demonstrates bypassing the intended protection by redefining Array.prototype.includes to always return false, allowing the injection of a property named polluted into Object.prototype. This could potentially lead to authentication bypass, denial of service, or remote code execution if the polluted property is passed to vulnerable sinks.Recommendations
set-in versions 2.0.1 through 2.0.4 should be updated to version 2.0.5.
Exploit
Correção
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Set-In