Prototype pollution in set-in

CRITICAL 9.8CVE-2020-28273 · GHSA-qr4p-c9wr-phr6 · Published 02/12/2020 · updated 17/06/2026

In short

CVE-2020-28273 is a CRITICAL (CVSS 9.8) vulnerability affecting set-in (set-in project), set-in.
Chance of exploitation in the next 30 days (EPSS): 4.0%, higher than 90.6% of all vulnerabilities.
Fix: update to 2.0.1 or later.

Package	Affected versions	Patched versions
set-in set-in_project	`≥ 1.0.0, ≤ 2.0.0`	No fix yet
set-in npm	`< 2.0.1`	`2.0.1`

Description

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

NVD description

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

References

nvd.nist.gov/vuln/detail/CVE-2020-28273 · ADVISORY
ahdinosaur/set-in commit e431eff · WEB
whitesourcesoftware.com/vulnerability-database/CVE-2020-28273 · WEB
whitesourcesoftware.com/vulnerability-database · Third Party Advisory

More vulnerabilities in set-in

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free