CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-25645
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
Severity
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dset_project:dset
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-23wx-cgxq-vpwx | npm | dset | <3.1.2 | 3.1.2 |
| GHSA-23wx-cgxq-vpwx | Maven | org.webjars.npm:dset | <3.1.2 | 3.1.2 |