Which versions of Prototype Pollution are affected by CVE-2024-21529?

The dset npm package versions below 3.1.4 contain a vulnerability in a widely-deployed data manipulation utility that could permit attackers to corrupt application state, disable security controls,…. A patch is available.

How to fix or mitigate CVE-2024-21529?

Within 24 hours, scan your software supply chain using tools like npm audit or SBOM analysis to identify all applications and services using dset before version 3.1.4. Within 7 days, update dset to version 3.1.4 across all development and staging environments and conduct regression testing to confirm compatibility. Within 30 days, deploy the patched version to all production systems and confirm that all running instances have been updated.

Prototype Pollution CVE-2024-21529

Q: What is the CVSS score of CVE-2024-21529?

CVE-2024-21529 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2024-09-11 report@snyk.io

Prototype Pollution Code Injection

8.8

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable via untrusted key input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); prototype pollution corrupts integrity (I:H) with possible DoS (A:L) and no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 17:17 vuln.today

v2 (cvss_changed)

Source Code Evidence Fetched

Jul 14, 2026 - 17:12 vuln.today

Analysis Updated

Jul 14, 2026 - 17:12 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

8.2 (HIGH) 8.8 (HIGH)

CVE Published

Sep 11, 2024 - 05:15 cve.org

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4,802 npm packages depend on dset (190 direct, 4,624 indirect)

Ecosystem-wide dependent count for version 3.1.4.

DescriptionCVE.org

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.

AnalysisAI

Prototype pollution in the npm package dset before 3.1.4 allows attackers who control the key path passed to the dset() function to inject a __proto__ property that is recursively assigned to every object in the running JavaScript program. Because dset is a tiny, widely-used deep-assignment utility often reached through untrusted JSON or user-supplied paths, successful pollution can corrupt application logic, bypass security checks, or escalate toward denial of service and, in some downstream contexts, code injection. EPSS is low (0.61%, 45th percentile) and there is no public exploit identified at time of analysis, but a vendor patch (3.1.4) is available.