CVE-2026-26021 - Vulnerability Analysis

Overview

set-in >= 2.0.1, < 2.0.5 contains a prototype pollution vulnerability caused by insufficient input validation allowing crafted input using Array.prototype to pollute Object.prototype, letting attackers modify object prototypes remotely, exploit requires crafted input.

Severity & Score

Impact

Attackers can modify Object.prototype, potentially leading to denial of service or privilege escalation.

Mitigation

Update to version 2.0.5 or later.

References

• https://github.com/ahdinosaur/set-in/commit/b8e1dabfdbd35c8d604b6324e01d03f280256c3d
• https://github.com/ahdinosaur/set-in/security/advisories/GHSA-2c4m-g7rx-63q7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 14, 2026

🔴 CVE-2026-26021 - Critical (9.8) set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollutio... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26021/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner