PT-2022-17233 · Set-In · Set-In

Cristian-Alexandru Staicu + 2 · Published 2022-03-17 · Updated 2026-03-16 · CVE-2022-25354

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions set-in versions prior to 2.0.3

Description The issue allows an attacker to perform Prototype Pollution via the setIn method, enabling them to merge object prototypes into it. This problem stems from an incomplete fix of a previous issue.

Recommendations For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider disabling the setIn method until a patch is available. Restrict access to the setIn method to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-25354

GHSA-6956-83FG-5WC5

SNYK-JS-SETIN-2388571

Affected Products

Set-In

References · 9

• 🔥 https://snyk.io/vuln/SNYK-JS-SETIN-2388571 · Exploit
• https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25354 · Security Note
• https://osv.dev/vulnerability/GHSA-6956-83fg-5wc5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25354 · Vendor Advisory
• https://github.com/ahdinosaur/set-in · Note
• https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f3490/index.js%23L5 · Note
• https://t.me/cibsecurity/39142 · Telegram Post
• https://twitter.com/pulsepatchio/status/2033561648389382648 · Twitter Post