CVE-2022-25645

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.

• CWE-1321

• https://github.com/lukeed/dset/blob/master/src/merge.js%23L9Broken Link
• https://github.com/lukeed/dset/pull/38
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-DSET-2330881Exploit, Third Party Advisory
• https://github.com/lukeed/dset/blob/master/src/merge.js%23L9Broken Link
• https://github.com/lukeed/dset/pull/38
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-DSET-2330881Exploit, Third Party Advisory

Published

May 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2564Prototype Pollution in GitHub repository automattic/mongoose…9.8
• CVE-2022-25640In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly en…7.5
• CVE-2022-25641Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2,…5.5
• CVE-2022-25642Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A …6.1
• CVE-2022-25643seatd-launch in seatd 0.6.x before 0.6.4 allows removing fil…9.8
• CVE-2022-25644All versions of package @pendo324/get-process-by-name are vu…9.8
• CVE-2022-25646All versions of package x-data-spreadsheet are vulnerable to…6.1
• CVE-2022-25647The package com.google.code.gson:gson before 2.8.9 are vulne…7.5
• CVE-2022-25648The package git before 1.11.0 are vulnerable to Command Inje…9.8
• CVE-2022-25649Multiple Improper Access Control vulnerabilities in StoreApp…8.8
• CVE-2022-2565The Simple Payment Donations & Subscriptions WordPress plugi…7.2
• CVE-2022-25650A vulnerability has been identified in Mendix Applications u…6.5