9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26021

CVE-2026-26021: Prototype pollution in set-in

set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26021

CVE-2026-26021:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
set-in	npm	>= 2.0.1, < 2.0.5	2.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the set-in library because it relies on Array.prototype.includes to sanitize user-provided paths and prevent prototype pollution. The core of the issue lies in the recursivelySetIn function, which is called by the main setIn function. This function checks if any segment of the input path is a forbidden key (like __proto__ or constructor) using POLLUTED_KEYS.includes(key). As demonstrated in the proof-of-concept, an attacker can override Array.prototype.includes to make it return false. This effectively disables the security check, allowing the function to write to Object.prototype and pollute it with arbitrary properties. This can lead to serious security consequences like denial of service, authentication bypass, or even remote code execution in applications that use this library. The patches show several attempts to fix this by moving the check between the recursivelySetIn and set functions, but the fundamental flaw of using a mutable includes method on a built-in prototype remained until the final patched version.

Vulnerable functions

recursivelySetIn

index.js

This function recursively processes the input path to set a value in a nested object. It uses `POLLUTED_KEYS.includes(key)` to check for forbidden keys like `__proto__` and `constructor`. The vulnerability lies in the fact that `Array.prototype.includes` can be overridden (monkey-patched) by a malicious user to always return `false`. This bypasses the security check, allowing an attacker to modify `Object.prototype` and pollute it.

setIn

index.js

This is the main exported function and the entry point for the vulnerability. It accepts a user-controlled `path` and passes it directly to the `recursivelySetIn` function, which contains the flawed validation logic. An exploit would involve calling this function with a crafted path.

set

index.js

In one of the intermediate (and still vulnerable) versions, the prototype pollution check using `POLLUTED_KEYS.includes(key)` was moved to this helper function. It suffers from the same flaw as `recursivelySetIn`, where `Array.prototype.includes` can be overridden to bypass the security check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.