Log in Start free

Vulnerability · Published Sep 12, 2021 · Assigned by snyk

CVE-2021-23440Prototype Pollution

High 7.3

In plain English

A high-severity security flaw in set-value. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.2%top 17.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-set-value3.0.1-3DEBIAN-CVE-2021-23440
Debian:13node-set-value3.0.1-3DEBIAN-CVE-2021-23440
Debian:14node-set-value3.0.1-3DEBIAN-CVE-2021-23440
NuGetset-value-nuget2.0.0GHSA-4jqc-8m5r-9rpr
Ubuntu:22.04:LTSnode-set-valueno fix listedUBUNTU-CVE-2021-23440
Ubuntu:24.04:LTSnode-set-valueno fix listedUBUNTU-CVE-2021-23440
Ubuntu:25.10node-set-valueno fix listedUBUNTU-CVE-2021-23440
Ubuntu:26.04:LTSnode-set-valueno fix listedUBUNTU-CVE-2021-23440
Ubuntu:26.10node-set-valueno fix listedUBUNTU-CVE-2021-23440
npmset-value3.0.3GHSA-4jqc-8m5r-9rpr
npmset-value2.0.1GHSA-4jqc-8m5r-9rpr
npmset-value4.0.1GHSA-4jqc-8m5r-9rpr

Affected products (as reported)

VendorProductVersions
n/a set-value <2.0.1>=3.0.0 <4.0.1

References