npm/set-value CVE-2019-10747: critical 9.8, EPSS 2.48%
Prototype Pollution in set-value
Action: Upgrade set-value to 2.0.1 or later.
npm i set-value@2.0.1npm i set-value@3.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.1 | - |
| 3.0.0 | 3.0.1 | - |
Fixed versions
| 2.0.1 | 3.0.1 |
Sources
- osv: GHSA-4g88-fppr-53pp
- https://nvd.nist.gov/vuln/detail/CVE-2019-10747
- https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f
- https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad
- https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT
- https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
- https://www.npmjs.com/advisories/1012
CVE-2019-10747 · published · modified · JSON