High severityNVD Advisory· Published Sep 12, 2021· Updated Sep 16, 2024
Prototype Pollution
CVE-2021-23440
Description
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
set-valuenpm | >= 4.0.0, < 4.0.1 | 4.0.1 |
set-value-nugetNuGet | < 2.0.0 | 2.0.0 |
set-valuenpm | < 2.0.1 | 2.0.1 |
set-valuenpm | >= 3.0.0, < 3.0.3 | 3.0.3 |
Affected products
3- set-value/set-valuedescription
- ghsa-coords2 versions
>= 4.0.0, < 4.0.1+ 1 more
- (no CPE)range: >= 4.0.0, < 4.0.1
- (no CPE)range: < 2.0.0
Patches
Vulnerability mechanics
References
12- github.com/advisories/GHSA-4jqc-8m5r-9rprghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-23440ghsaADVISORY
- github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245ghsaWEB
- github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452ghsax_refsource_MISCWEB
- github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31adghsaWEB
- github.com/jonschlinkert/set-value/pull/33ghsax_refsource_MISCWEB
- github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296aghsaWEB
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212ghsax_refsource_MISCWEB
- snyk.io/vuln/SNYK-JS-SETVALUE-1540541ghsax_refsource_MISCWEB
- www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2ghsaWEB
- www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/mitrex_refsource_MISC
- www.oracle.com/security-alerts/cpujan2022.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.