Critical severity9.8NVD Advisory· Published Dec 2, 2020· Updated Jun 17, 2026

CVE-2020-28273

Description

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
set-innpm	< 2.0.1	2.0.1

Affected products

Set In Project/Set In
cpe:2.3:a:set-in_project:set-in:*:*:*:*:*:*:*:*
Range: >=1.0.0,<=2.0.0
set-in/set-indescription
ghsa-coords
pkg:npm/set-in
Range: < 2.0.1

Patches

Vulnerability mechanics

References

github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88nvdPatchThird Party AdvisoryWEB
www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-qr4p-c9wr-phr6ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-28273ghsaADVISORY
www.whitesourcesoftware.com/vulnerability-databasenvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000