CVE-2024-21529

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-21529
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21529.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-21529
Aliases
Downstream
Published
2024-09-11T05:00:01.507Z
Modified
2026-08-12T03:30:36.857436882Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.

Database specific 
{
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21529.json",
    "cna_assigner": "snyk"
}
References

Affected packages

Git / github.com/lukeed/dset

Affected ranges

Type
GIT
Repo
https://github.com/lukeed/dset
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
05b1ec0f8cebe3b5d5667285bc7da90f38a7215e
Fixed
16d6154e085bef01e99f01330e5a421a7f098afa
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.4"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v2.*
v2.0.0
v2.0.1
v2.1.0
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.1.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21529.json"