Every CVE Search/ Get API key

CVE-2019-10747

Prototype Pollution in set-value

9.8 CriticalFix available

CVE-2019-10747 is a critical vulnerability (CVSS 9.8) in Set-value Project Set-value, published August 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in set-value 2.0.1.

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.48%Down 2.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Record
CVE-2019-10747
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Record
CVE-2019-10747
Updated
2026-11-02
EUVDEUVD-2019-0617 No score

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Record
EUVD-2019-0617
Updated
2026-11-03
GitHub AdvisoriesGHSA-4g88-fppr-53pp 9.8

Prototype Pollution in set-value

Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

Recommendation

If you are using set-value 3.x, upgrade to version 3.0.1 or later. If you are using set-value 2.x, upgrade to version 2.0.1 or later.

Record
GHSA-4g88-fppr-53pp
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-1321
Updated
2026-11-02
OSV 9.8

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Record
CVE-2019-10747
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-10747 9.8

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Record
DEBIAN-CVE-2019-10747
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-4g88-fppr-53pp 9.8

Prototype Pollution in set-value

Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

Recommendation

If you are using set-value 3.x, upgrade to version 3.0.1 or later. If you are using set-value 2.x, upgrade to version 2.0.1 or later.

Record
GHSA-4g88-fppr-53pp
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-1321
Updated
2026-11-02
OSVRHSA-2021:0485 8.1

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record
RHSA-2021:0485
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0549 8.1

Red Hat Security Advisory: nodejs:12 security update

Record
RHSA-2021:0549
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:0549 8.1

Moderate: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

  • nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  • nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  • nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

  • nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  • nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:0549
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-10747 9.8

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Record
UBUNTU-CVE-2019-10747
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:0549 No score

Moderate: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

  • nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  • nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  • nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

  • nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  • nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:0549
Updated
2026-11-02
OSVCLSA-2026-1782954034 No score

TuxCare security update for set-value (2 CVEs)

TuxCare rebuilt set-value to address 2 CVEs. Fixed in 2.0.0-tuxcare.1.

Record
CLSA-2026-1782954034
Updated
2026-11-02
OSVMGASA-2020-0230 No score

Updated nodejs-set-value packages fix security vulnerability

Updated nodejs-set-value package fixes security vulnerability:

A vulnerability was found in NOdejs set-value, where set-value is vulnerable to prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads (CVE-2019-10747).

Record
MGASA-2020-0230
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
set-value
npm
 before 2.0.1
2.0.1
set-value
npm
 3.0.0 to 3.0.0
3.0.1
nodejs-nodemon
AlmaLinux:8
 before 2.0.3-1.module_el8.4.0+2521+c668cc9f
2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
set-value
TuxCare:npm
 2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions
2.0.0
2.0.0-tuxcare.1
node-set-value
Debian:12
 before 0.4.0-2
0.4.0-2
node-set-value
Debian:13
 before 0.4.0-2
0.4.0-2
node-set-value
Debian:14
 before 0.4.0-2
0.4.0-2
Show 22 moreShow less
Affected packages
PackageAffectedFixed
set-value
npm
 3.0.0 up to 3.0.1
3.0.1
nodejs-set-value
Mageia:7
 before 3.0.2-1.mga7
3.0.2-1.mga7
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
 before 0:2.0.3-1.el7
0:2.0.3-1.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.14.10-12.20.1.1.el7
0:6.14.10-12.20.1.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.3-1.module+el8.3.0+9715+1718613f
0:2.0.3-1.module+el8.3.0+9715+1718613f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c
1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
0:2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.3.0+100+234774f7
0:2.0.3-1.module+el8.3.0+100+234774f7
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.4.0+638+5344c6f7
0:2.0.3-1.module+el8.4.0+638+5344c6f7
nodejs-packaging
Rocky Linux:8
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
node-set-value
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.4.0-1
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 56 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open