CVE-2022-25354

The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)

• CWE-1321

• https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f3490/index.js%23L5Broken Link
• https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-SETIN-2388571Exploit, Patch, Third Party Advisory
• https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f3490/index.js%23L5Broken Link
• https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-SETIN-2388571Exploit, Patch, Third Party Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25347Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…7.5
• CVE-2022-25348Untrusted search path vulnerability in AttacheCase ver.4.0.2…7.8
• CVE-2022-25349All versions of package materialize-css are vulnerable to Cr…5.4
• CVE-2022-2535The SearchWP Live Ajax Search WordPress plugin before 1.6.2 …5.3
• CVE-2022-25350All versions of the package puppet-facter are vulnerable to …7.8
• CVE-2022-25352The package libnested before 1.5.2 are vulnerable to Prototy…9.8
• CVE-2022-25355EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improp…5.3
• CVE-2022-25356Alt-N MDaemon Security Gateway through 8.5.0 allows Security…5.3
• CVE-2022-25357Pexip Infinity 27.x before 27.2 has Improper Access Control.…5.3
• CVE-2022-25358A ..%2F path traversal vulnerability exists in the path hand…5.3
• CVE-2022-25359On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 d…9.1
• CVE-2022-2536The Transposh WordPress Translation plugin for WordPress is …5.3