Vulnerability record · CVE-2020-28273 · published 2 December 2020

CVE-2020-28273: Set-in project set-in vulnerability

SSet In Project · Set In

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

9.8 CVSS 3.1 Critical EPSS 4.0% · top 9.7%

9.8CVSS 3.1 base score, v2 7.5

4.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

SSet In Set In Project

References

Link	Tags
https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88	PatchThird Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database	Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273	ExploitThird Party Advisory
https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88	PatchThird Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database	Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273	ExploitThird Party Advisory

Track CVE-2020-28273 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-25354Set-in project set-in prototype pollution vulnerabilityThe package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into …EPSS 1.9%17 Mar 2022 9.4CVE-2026-26021Set-in project set-in prototype pollution vulnerabilityset-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package …EPSS 0.49%11 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2020-28273), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.