CVE-2026-26021
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.4
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.46%
- CWE
- CWE-1321
- Published
- 2026-02-11
- Last modified
- 2026-03-12
Affected products
- ahdinosaur set-in
Weakness type
Related vulnerabilities
- CVE-2026-86078 — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
- CVE-2026-81994 — Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
- CVE-2026-85625 — sift 17.1.3 Prototype Pollution Remote Code Execution via $where
- CVE-2026-63376 — toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
- CVE-2026-85063 — node-csv: Prototype replacement still reachable via columns path
- CVE-2026-82404 — TOON: Prototype pollution when decoding untrusted TOON input
- CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages
- CVE-2026-84367 — joi: object().rename() with a template target can set the validated object's prototype