CVE-2022-25645
Prototype Pollution
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Prototype Pollution
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Record
CVE-2022-25645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P - Updated
- 2026-11-02
EUVDEUVD-2022-1897
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Record
EUVD-2022-1897- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23wx-cgxq-vpwx
Prototype Pollution in dset
All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Record
GHSA-23wx-cgxq-vpwx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains proto, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Record
CVE-2022-25645- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-23wx-cgxq-vpwx
Prototype Pollution in dset
All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or prototype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Record
GHSA-23wx-cgxq-vpwx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-25645 No score
CVE-2022-25645 in dset - Patched by Root
Root has patched CVE-2022-25645 in the dset package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-25645- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dsetnpm |
before 3.1.2 | 3.1.2 |
org.webjars.npm:dsetMaven |
before 3.1.2 | 3.1.2 |
org.webjars.npm:dsetMaven |
before 3.1.2, plus listed versions 3.0.03.1.03.1.1 |
3.1.2 |
dsetRoot:npm |
before 3.1.2-aikido.1 | 3.1.2-aikido.1 |
@rootio/dsetRoot:npm |
before 3.1.2-root.io.1 | 3.1.2-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25645 is a medium vulnerability (CVSS 6.5) in Dset Project Dset, published May 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in dset 3.1.2.