set-in Affected by Prototype Pollution
Summary
A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
Details
The vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.
PoC
Steps to reproduce
- Install latest version of set-in using npm install or cloning from git
- Run the following code snippet:
Array.prototype.includes = () => false;
const si = require('set-in');
const obj = {};
console.log({}.polluted);
si(obj, [
'constructor',
'prototype',
'polluted'
], 'yes');
console.log('{ ' + obj.polluted + ', ' + 'yes' + ' }'); // prints yes -> indicating that the patch was bypassed and prototype pollution occurredExpected behavior
Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console:
undefined
undefined OR throw an ErrorActual behavior
Object.prototype is polluted This is printed on the console:
undefined
yesImpact
This is a prototype pollution vulnerability, which can have severe security implications depending on how set-in is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected. It could potentially lead to the following problems:
- Authentication bypass
- Denial of service
- Remote code execution (if polluted property is passed to sinks like eval or child_process)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | set-in | >= 2.0.1, < 2.0.5 | 2.0.5 |
References
- https://github.com/ahdinosaur/set-in/security/advisories/GHSA-2c4m-g7rx-63q7
- https://nvd.nist.gov/vuln/detail/CVE-2026-26021
- https://github.com/ahdinosaur/set-in/pull/6
- https://github.com/ahdinosaur/set-in/commit/34842cc02de3fd65d6f8bd0b268347e7b390125b
- https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24
- https://github.com/ahdinosaur/set-in/commit/b8e1dabfdbd35c8d604b6324e01d03f280256c3d
- https://github.com/ahdinosaur/set-in/commit/d87c1a09fa2edb55cd76440a67d83d1cb828df11
- https://github.com/ahdinosaur/set-in
- CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H- Weakness (CWE)
CWE-1321- Platform
- npm
- Package
set-in- Disclosed
- 11.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2c4m-g7rx-63q7 - CC BY 4.0
Vulnerability history: set-in
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 03.2021 02.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
set-in Affected by Prototype Pollution this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.