CVE-2022-25645

Name of the Vulnerable Software and Affected Versions dset versions prior to 3.1.2

Description The issue arises from the dset function's validation process in 'dset/merge' mode, where it checks for prototype pollution by looking for proto, constructor, or prototype in the top-level path. However, this check can be bypassed by crafting a malicious object, leading to prototype pollution.

Recommendations For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue.