The vulnerability occurs in the npm package set-in (>=2.0.1, <2.0.5) and allows an attacker to pollute Object.prototype by supplying a crafted input that uses Array.prototype. The flaw is a prototype pollution weakness (CWE-1321) that can be exploited to alter built‑in prototypes, creating a foundation for subsequent attacks such as arbitrary code execution, malicious data manipulation, or privilege escalation. The impact is high because modifying Object.prototype affects every object in the JavaScript runtime, potentially compromising all code that runs in that process.

The affected vendor is ahdinosaur and the product is set-in, a Node.js utility for setting nested values in objects. Vulnerable versions include any release in the range 2.0.1 through 2.0.4. Projects that depend on these package versions, either directly or indirectly, are at risk. The fix is provided in version 2.0.5 and later.

With a CVSS score of 9.4 the vulnerability is rated critical, while the EPSS score of less than 1% indicates a low current exploitation probability but that could change as attackers develop payloads. The vulnerability is not listed in the CISA KEV catalog. Attackers could invoke the flaw remotely by providing specially crafted input to set-in, such as an array payload that includes offending keys, thereby polluting prototypes in a running application. The flaw’s remote nature means that any service receiving untrusted data through set-in could be compromised if not patched.