-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dset | npm | < 3.1.4 | 3.1.4 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from improper key type handling in both dset implementations. The commit shows critical changes to key coercion ('k = ''+keys[i++]') in both index.js and merge.js, indicating both were vulnerable. The added test case demonstrates exploitation via array-based proto paths, which would bypass the original string-based checks. The prototype pollution occurs because non-string keys (like arrays) weren't properly converted before prototype pollution checks, allowing attackers to manipulate Object.prototype through nested structures.
KEV Misses 88% of Exploited CVEs- Get the report