nodejs-set-value: prototype pollution in function set-value

🗓️ 16 Feb 2021 14:25:52Reported by RedHatType

redhat🔗 access.redhat.com👁 16 Views

Prototype pollution in nodejs-set-value lets Object.prototype be modified via payloads.

Reporter	Title	Published	Views	Family All 71
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains security vulnerabilities	13 May 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found with third-party libraries used by IBM® MobileFirst Platform	17 Feb 202315:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in React, webpack and Node.js modules affect Tivoli Netcool/OMNIbus WebGUI	6 Oct 202204:09	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Automation Manager - Node.js (CVE-2019-10747)	15 May 202312:07	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js modules	29 Aug 202008:56	–	ibm
AlmaLinux	Moderate: nodejs:12 security update	16 Feb 202107:34	–	almalinux
BDU FSTEC	The vulnerability of the set function in the set-value library of the Afroara Application Software Center, related to uncontrolled changes in object prototypes’ attributes, allows attackers to execute a “prototype pollution” attack.	9 Jun 202100:00	–	bdu_fstec
Tenable Nessus	CentOS 8 : nodejs:12 (CESA-2021:0549)	11 Mar 202100:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2021_0549)	1 Oct 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8.3	aarch64	nodejs	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
Red Hat Enterprise Linux	8.3	ppc64le	nodejs	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
Red Hat Enterprise Linux	8.3	s390x	nodejs	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
Red Hat Enterprise Linux	8.3	x86_64	nodejs	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
Red Hat Enterprise Linux	8.3	aarch64	nodejs-debuginfo	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-debuginfo-1:12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
Red Hat Enterprise Linux	8.3	ppc64le	nodejs-debuginfo	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-debuginfo-1:12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm
Red Hat Enterprise Linux	8.3	s390x	nodejs-debuginfo	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-debuginfo-1:12.20.1-1.module+el8.3.0+9503+19cb079c.s390x.rpm
Red Hat Enterprise Linux	8.3	x86_64	nodejs-debuginfo	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-debuginfo-1:12.20.1-1.module+el8.3.0+9503+19cb079c.x86_64.rpm
Red Hat Enterprise Linux	8.3	aarch64	nodejs-debugsource	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-debugsource-1:12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64.rpm
Red Hat Enterprise Linux	8.3	ppc64le	nodejs-debugsource	1:12.20.1-1.module+el8.3.0+9503+19cb079c	nodejs-debugsource-1:12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2019-10747
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-10747
cve	www.cve.org/CVERecord

28 Jun 2026 09:07Current

7.2High risk

Vulners AI Score7.2

CVSS 27.5

CVSS 3.19.8

EPSS0.02475

prototype pollution nodejs set value mixin deep object prototype payloads data integrity