CVE-2026-26021: Set-In Project Set-In

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.

Affected products

• Set-In Project Set-In: from 2.0.1, before 2.0.5 (fixed in 2.0.5)

Published 2026-02-11. Last modified 2026-06-17.