View all vulnerabilities

CVE-2019-10747

Prototype Pollution in set-value

Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.## RecommendationIf you are using `set-value` 3.x, upgrade to version 3.0.1 or later.If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
9.8
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
set-value < 2.0.1; set-value >= 3.0.0 < 3.0.1
Severity
Ecosystem
JavaScript
Publish Date
August 27, 2019
Modified Date
January 14, 2025