{"id":"CVE-2021-23440","aliases":["AZL-45225","CLSA-2026-1782954034","DEBIAN-CVE-2021-23440","EUVD-2021-1976","GHSA-4jqc-8m5r-9rpr","UBUNTU-CVE-2021-23440"],"status":"published","title":"Prototype Pollution","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02206,"percentile":0.82799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-843"],"published":"2021-09-12T12:55:10Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"NuGet","package":"set-value-nuget","fixed_in":["2.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"set-value","fixed_in":["2.0.1","4.0.1","3.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-set-value","fixed_in":["3.0.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-set-value","fixed_in":["3.0.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-set-value","fixed_in":["3.0.1-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"set-value-nuget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-3"}]}]},{"source":"osv","ecosystem":"npm","package":"set-value","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"set-value-nuget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"set-value","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"set-value","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0-1","0.4.0-2","3.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-2","3.0.1-3","4.1.0-2","4.1.0+~4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+~4.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+~4.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+~4.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-set-value","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+~4.0.1-2","4.1.0+~4.0.3-1"]}],"products":[{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"set-value_project","product":"set-value"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/jonschlinkert/set-value/pull/33","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23440","tags":["web","advisory"]},{"url":"https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a","tags":["web"]},{"url":"https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad","tags":["web"]},{"url":"https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4jqc-8m5r-9rpr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23440","tags":["advisory"]},{"url":"https://github.com/jonschlinkert/set-value","tags":["package"]},{"url":"https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-23440","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23440","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23440","title":"Prototype Pollution","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T12:55:10.983Z","modified":"2024-09-16T19:20:29.828Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-1976","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T12:55:10Z","modified":"2024-09-16T19:20:29Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:55:23.696592Z"}],"ghsa":[{"id":"GHSA-4jqc-8m5r-9rpr","title":"Prototype Pollution in set-value","description":"This affects the package `set-value`. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-13T20:09:36Z","modified":"2023-11-03T20:25:00Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-843","CWE-1321"],"updated_at":"2026-11-02T14:37:11.48574Z"}],"nvd":[{"id":"CVE-2021-23440","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T13:15:07.383Z","modified":"2026-06-17T03:38:46.06Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"AZL-45225","title":"CVE-2021-23440 affecting package js-jquery 3.5.0-4","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T13:15:07Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2021-23440","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T13:15:07.383Z","modified":"2026-10-20T10:53:37.539827549Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23440","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T13:15:07.383Z","modified":"2026-10-23T18:04:50.103532076Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-4jqc-8m5r-9rpr","title":"Prototype Pollution in set-value","description":"This affects the package `set-value`. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-13T20:09:36Z","modified":"2025-01-14T09:11:57.26642Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321","CWE-843"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"UBUNTU-CVE-2021-23440","description":"This affects the package set-value before \u003c2.0.1, \u003e=3.0.0 \u003c4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","status":"published","published":"2021-09-12T13:15:00Z","modified":"2026-10-17T12:56:19.632572649Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2026-1782954034","title":"TuxCare security update for set-value (2 CVEs)","description":"TuxCare rebuilt set-value to address 2 CVEs. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T09:47:51.655367489Z","updated_at":"2026-11-02T15:43:45.794021Z"}]}}