CVE-2021-23440: Prototype Pollution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-12 · updated 2026-06-17
Weakness: CWE-843

Description

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

Affected products

Oracle Communications Cloud Native Core Policy: 1.14.0
set-value: before 2.0.1; from 3.0.0 before 4.0.1 — fixed in 2.0.1, 4.0.1

How to fix

Upgrade to a fixed version: set-value 2.0.1, 4.0.1. Check the vendor advisory for mitigations.

References

https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452
https://github.com/jonschlinkert/set-value/pull/33
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212
https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
https://www.oracle.com/security-alerts/cpujan2022.html
https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452
https://github.com/jonschlinkert/set-value/pull/33
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212
https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
https://www.oracle.com/security-alerts/cpujan2022.html

Get alerted when CVE-2021-23440 or the next vulnerability affects your stack