CVE-2022-25354

CVE-2022-25354 affects the JavaScript package set-in, with versions before 2.0.3 vulnerable to Prototype Pollution via the setIn method. Root cause is an incomplete fix of CVE-2020-28273. Exploitation details are not provided in the documents; public references describe the issue and advisories. ...

CVE-2020-28273

The CVE-2020-28273 entry concerns a prototype pollution vulnerability in the npm package set-in, affected in versions 1.0.0 through 2.0.0. The root cause is prototype pollution via the setIn method, which allows merging object prototypes and can lead to a denial of service and may enable remote c...

CVE-2026-26021

CVE-2026-26021 affects the npm package set-in (versions >=2.0.1,