-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the dset function's handling of the 'keys' parameter. The function (exported as default in src/index.js) recursively sets nested properties without checking if intermediate keys reference the prototype chain. The provided PoC demonstrates prototype pollution by setting 'proto.polluted', and the commit diff shows the vulnerable logic was in this function. The lack of validation for prototype-related keys before property assignment is the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dset | npm | >= 1.0.0, < 2.0.1 | 2.0.1 |
JavaScriptJavaScriptOngoing coverage of React2Shell