CVE-2024-21529High· 8.2▾ TwilightVersions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Obj…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
0.7% → 0.8%
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118777Medium· 4.8Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
CVE-2026-118678High· 7.1n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
CVE-2026-118649High· 8.3n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
CVE-2026-118243Medium· 5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
CVE-2026-118248Medium· 6.9Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype