-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the set function in main.js which processes nested object paths. The unpatched version lacked checks for prototype-pollution vectors like 'proto' and 'constructor' in path segments. The commit 102cc6b2e1d1e0c928ced87e75df759d5541ff60 added an isProto check to prevent this, confirming the original function's vulnerability. The PoC demonstrates prototype pollution via proto.isAdmin manipulation, directly implicating this core path-processing function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @strikeentco/set | npm | = 1.0.0 | 1.0.1 |
Ongoing coverage of React2Shell