CVE-2022-25352

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)

• CWE-1321

• https://github.com/dominictarr/libnested/blob/master/index.js%23L22Broken Link
• https://github.com/dominictarr/libnested/commit/c1129865d75fbe52b5a4f755ad3110ca5420f2e1Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-LIBNESTED-2342117Exploit, Patch, Third Party Advisory
• https://github.com/dominictarr/libnested/blob/master/index.js%23L22Broken Link
• https://github.com/dominictarr/libnested/commit/c1129865d75fbe52b5a4f755ad3110ca5420f2e1Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-LIBNESTED-2342117Exploit, Patch, Third Party Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25345All versions of package @discordjs/opus are vulnerable to De…7.5
• CVE-2022-25347Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…7.5
• CVE-2022-25348Untrusted search path vulnerability in AttacheCase ver.4.0.2…7.8
• CVE-2022-25349All versions of package materialize-css are vulnerable to Cr…5.4
• CVE-2022-2535The SearchWP Live Ajax Search WordPress plugin before 1.6.2 …5.3
• CVE-2022-25350All versions of the package puppet-facter are vulnerable to …7.8
• CVE-2022-25354The package set-in before 2.0.3 are vulnerable to Prototype …9.8
• CVE-2022-25355EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improp…5.3
• CVE-2022-25356Alt-N MDaemon Security Gateway through 8.5.0 allows Security…5.3
• CVE-2022-25357Pexip Infinity 27.x before 27.2 has Improper Access Control.…5.3
• CVE-2022-25358A ..%2F path traversal vulnerability exists in the path hand…5.3
• CVE-2022-25359On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 d…9.1