Prototype pollution in dset
Priority HIGH 77CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00751 55th percentileScored 2026-11-07
Fix Fixed dset: 3.1.4org.webjars.npm:dset: 3.1.4+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dset | before 3.1.4 | 3.1.4 | Patch available | CNA |
| — | org.webjars.npm:dset | before 3.1.4 | 3.1.4 | Patch available | CNA |
| — | dset (npm) | before 3.1.4 | 3.1.4 | Patch available | GHSA-f6v4-cf5j-vf3w |
- dset Vendor— Affected before 3.1.4 Fixed in 3.1.4 Patch available CNA
- org.webjars.npm:dset Vendor— Affected before 3.1.4 Fixed in 3.1.4 Patch available CNA
- dset (npm) Vendor— Affected before 3.1.4 Fixed in 3.1.4 Patch available GHSA-f6v4-cf5j-vf3w
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dset_project:dset:*:*:*:*:*:node.js:*:* | — | — | Dset Project |
- cpe:2.3:a:dset_project:dset:*:*:*:*:*:node.js:*:* Versions — — ·Dset Project
Remediation
- Fix · CNA dset Fixed in 3.1.4
- Fix · CNA org.webjars.npm:dset Fixed in 3.1.4
- Fix · GHSA-f6v4-cf5j-vf3w dset (npm) Fixed in 3.1.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
Not affected: 3 products
- OpenShift Serverless
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.3 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21529
- 2026-10-03 Alias added: GHSA-f6v4-cf5j-vf3w
- 2026-10-27 Affected versions changed · Red Hat
References
Sources
- CVE-2024-21529 · CVE Program
- CVE-2024-21529 · NVD
- FIRST EPSS
- GHSA-f6v4-cf5j-vf3w · GitHub Advisory Database · CC BY 4.0
- CVE-2024-21529 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences