CVE-2024-21529
dset Prototype Pollution vulnerability
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
- Record
CVE-2024-21529- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2024-2781
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
- Record
EUVD-2024-2781- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f6v4-cf5j-vf3w
dset Prototype Pollution vulnerability
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
- Record
GHSA-f6v4-cf5j-vf3w- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
- Record
CVE-2024-21529- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
- Record
CVE-2024-21529- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-f6v4-cf5j-vf3w
dset Prototype Pollution vulnerability
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
- Record
GHSA-f6v4-cf5j-vf3w- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVCLSA-2026-1780447840 No score
TuxCare security update for dset (1 CVE)
TuxCare rebuilt dset to address 1 CVE. Fixed in 3.1.3-tuxcare.1.
- Record
CLSA-2026-1780447840- Updated
- 2026-11-02
OSVCLSA-2026-1788560246 No score
TuxCare security update for dset (1 CVE)
TuxCare rebuilt dset to address 1 CVE. Fixed in 3.1.2-tuxcare.1.
- Record
CLSA-2026-1788560246- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-21529 No score
CVE-2024-21529 in dset - Patched by Root
Root has patched CVE-2024-21529 in the dset package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-21529- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dsetnpm |
before 3.1.4 | 3.1.4 |
dsetTuxCare:npm |
3.1.3-tuxcare.0 up to 3.1.3-tuxcare.1, plus listed versions 3.1.3 |
3.1.3-tuxcare.1 |
dsetTuxCare:npm |
3.1.2-tuxcare.0 up to 3.1.2-tuxcare.1, plus listed versions 3.1.2 |
3.1.2-tuxcare.1 |
dsetRoot:npm |
before 3.1.2-aikido.1 | 3.1.2-aikido.1 |
@rootio/dsetRoot:npm |
before 3.1.2-root.io.1 | 3.1.2-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21529 is a high vulnerability (CVSS 8.8) in Dset Project Dset, published September 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in dset 3.1.4.
References
security.snyk.io/vuln/SNYK-JS-DSET-7116691
github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa
nvd.nist.gov/vuln/detail/CVE-2024-21529