Description
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | set-value | <2.0.1, >=3.0.0 <4.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-set-value | 3.0.1-3 | — |
| Debian 13 | node-set-value | 3.0.1-3 | — |
| Debian 12 | node-set-value | 3.0.1-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-set-value | No fix yet | — |
| Ubuntu 26.04 LTS | node-set-value | No fix yet | — |
| Ubuntu 25.10 | node-set-value | No fix yet | — |
| Ubuntu 24.04 LTS | node-set-value | No fix yet | — |
| Ubuntu 22.04 LTS | node-set-value | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-set-value | No fix yet | — |
| Ubuntu 18.04 LTS | node-set-value | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | set-value | >= 4.0.0, < 4.0.1 | 4.0.1 | GHSA-4jqc-8m5r-9rpr |
| npm | set-value | < 2.0.1 | 2.0.1 | GHSA-4jqc-8m5r-9rpr |
| npm | set-value | >= 3.0.0, < 3.0.3 | 3.0.3 | GHSA-4jqc-8m5r-9rpr |
| NuGet | set-value-nuget | < 2.0.0 | 2.0.0 | GHSA-4jqc-8m5r-9rpr |
Advisories 2
- WID-SEC-2022-1603 IBM Tivoli Netcool/OMNIbus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 24, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212
- https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452
- https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
- https://github.com/jonschlinkert/set-value/pull/33
- https://www.oracle.com/security-alerts/cpujan2022.html