Vulnerability · Published Feb 8, 2021 · Assigned by Mend
CVE-2021-25913
Critical 9.8
In plain English
A critical-severity security flaw in set-or-get. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)4.4%top 8.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | set-or-get | 1.2.11 | GHSA-6rv4-4qv6-88g2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | set-or-get | 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10 |