CVE-2021-25952 Prototype polluation in just-safe-set
Prototype pollution in just-safe-set allows attackers to cause denial of service and potentially execute remote code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25952?
CVE-2021-25952 is a critical vulnerability in just-safe-set, published on 7 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Weakness: CWE-1321
Which versions are affected by CVE-2021-25952?
2 open source packages ship an affected version, including just-safe-set. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
just-safe-set npm | From 1.0.0 | 2.2.2 |
just-safe-set npm | From 1.0.0 | 2.2.2 |
Products include Just-Safe-Set Project Just-Safe-Set.
How do I fix CVE-2021-25952?
Upgrade just-safe-set to 2.2.2 or later.
Is CVE-2021-25952 being exploited?
There is no known exploitation of CVE-2021-25952 in the wild and no public exploit code.
Sources
Also known as GHSA-v26w-gcxh-v4r7.