Prototype Pollution

Vulnerability

All versions of the dset package (npm) are vulnerable to Prototype Pollution when using the dset/merge mode. The dset function attempts to prevent prototype pollution by validating that the top-level path does not contain __proto__, constructor, or prototype. However, a crafted object can bypass this check by nesting these sensitive keys deeper in the path, leading to pollution of Object.prototype [1][3].

Exploitation

An attacker can exploit this vulnerability by providing a malicious object that, when merged via dset/merge, sets properties on the global Object.prototype. The attacker does not require authentication or special privileges; the vulnerability is triggered if the application merges untrusted user input into an object using the merge mode [3][4].

Impact

Successful exploitation results in Prototype Pollution, which can cause denial of service (via property shadowing or exceptions) or lead to remote code execution if the application's logic relies on properties inherited from Object.prototype. The exact impact depends on how the application uses the polluted properties [3].

Mitigation

As of the latest release, no patch has been published for this vulnerability. Users should avoid using dset/merge with untrusted data and consider switching to the default dset mode, which is not vulnerable to this bypass. Monitor the GitHub repository [2] for future updates. If using the web Java archive (org.webjars.npm:dset), similar workarounds apply [4].