CVE-2024-21529 dset Prototype Pollution vulnerability
Prototype pollution in dset allows attackers to inject malicious properties, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21529?
CVE-2024-21529 is a high-severity vulnerability in dset, published on 11 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.
Weakness: CWE-1321
Which versions are affected by CVE-2024-21529?
2 open source packages ship an affected version, including dset.
| Package | Affected | Fixed in |
|---|---|---|
dset npm | All versions | 3.1.4 |
dset npm | All versions | 3.1.4 |
How do I fix CVE-2024-21529?
Upgrade dset to 3.1.4 or later.
Is CVE-2024-21529 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21529 exists.
Sources
Also known as CLSA-2026-1780447840, CLSA-2026-1788560246, GHSA-f6v4-cf5j-vf3w, ROOT-APP-NPM-CVE-2024-21529.