VulnerableCode Package Details - pkg:npm/set-value@1.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-cu35-t78a-wfcj Aliases: CVE-2019-10747 GHSA-4g88-fppr-53pp	Prototype Pollution in set-value Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation If you are using `set-value` 3.x, upgrade to version 3.0.1 or later. If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.	2.0.1 Affected by 0 other vulnerabilities. 3.0.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-eq42-z92a-ffet Aliases: CVE-2021-23440 GHSA-4jqc-8m5r-9rpr	Access of Resource Using Incompatible Type (Type Confusion) This affects the package set-value A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.	2.0.1 Affected by 0 other vulnerabilities. 3.0.3 Affected by 0 other vulnerabilities. 4.0.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-cu35-t78a-wfcj
Aliases:
CVE-2019-10747
GHSA-4g88-fppr-53pp

Prototype Pollution in set-value Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation If you are using `set-value` 3.x, upgrade to version 3.0.1 or later. If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.

2.0.1
Affected by 0 other vulnerabilities.

3.0.1
Affected by 1 other vulnerability.

VCID-eq42-z92a-ffet
Aliases:
CVE-2021-23440
GHSA-4jqc-8m5r-9rpr

Access of Resource Using Incompatible Type (Type Confusion) This affects the package set-value A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

2.0.1
Affected by 0 other vulnerabilities.

3.0.3
Affected by 0 other vulnerabilities.

4.0.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T21:30:59.742443+00:00	GitLab Importer	Affected by	VCID-eq42-z92a-ffet	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2021-23440.yml	38.4.0
2026-04-16T20:56:55.506713+00:00	GitLab Importer	Affected by	VCID-cu35-t78a-wfcj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2019-10747.yml	38.4.0
2026-04-11T22:44:07.758183+00:00	GitLab Importer	Affected by	VCID-eq42-z92a-ffet	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2021-23440.yml	38.3.0
2026-04-11T22:07:56.966833+00:00	GitLab Importer	Affected by	VCID-cu35-t78a-wfcj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2019-10747.yml	38.3.0
2026-04-02T22:54:11.256019+00:00	GitLab Importer	Affected by	VCID-eq42-z92a-ffet	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2021-23440.yml	38.1.0
2026-04-02T22:20:41.786399+00:00	GitLab Importer	Affected by	VCID-cu35-t78a-wfcj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2019-10747.yml	38.1.0
2026-04-01T17:12:26.455119+00:00	GitLab Importer	Affected by	VCID-eq42-z92a-ffet	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2021-23440.yml	38.0.0
2026-04-01T16:38:27.984980+00:00	GitLab Importer	Affected by	VCID-cu35-t78a-wfcj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/set-value/CVE-2019-10747.yml	38.0.0