TI-2026-21035 CVE-2026-26021 · GHSA-2c4m-g7rx-63q7
Prototype pollution in set-in
Priority HIGH 76
set-in provides the set value of nested associative structure given array of keys.
Set-in Project
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Set-in Project records in CISA KEVNo Set-in Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records in Set-in · all components
TI-2020-17167 CVE-2020-28273 · GHSA-qr4p-c9wr-phr6
Prototype pollution in set-in
Priority MEDIUM 49
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
TI-2022-09041 CVE-2022-25354 · GHSA-6956-83fg-5wc5
Prototype pollution in set-in
Priority MEDIUM 46
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it.