CVE-2020-28277

Prototype pollution in the npm module dset (versions 1.0.0–2.0.1) allows an attacker to pollute Object.prototype, enabling DoS and potentially remote code execution. Affected function is the export logic handling obj, keys, val without proper validation. Documented exploitation points include man...