CVE-2021-25949: 
JavaScript vulnerability analysis and mitigation

Prototype pollution vulnerability in 'set-getter' version 0.1.0 was discovered that allows an attacker to cause a denial of service and potentially lead to remote code execution. The vulnerability was disclosed on June 10, 2021, affecting the NPM module 'set-getter' (WhiteSource DB, NVD).

The vulnerability exists in the setGetter() function which accepts obj, prop, and getter as arguments. The function lacks proper validation on the values passed into the prop argument, allowing attackers to supply malicious values that include the proto property. Due to the absence of validation before property assignment to check whether the assigned argument is the Object's own property, attackers can pollute the Object prototype. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (WhiteSource DB).

The successful exploitation of this vulnerability can lead to denial of service conditions and potentially remote code execution. When exploited, attackers can create non-existent properties or manipulate existing properties in the Object prototype, affecting all objects in the application (WhiteSource DB).

The vulnerability is exploitable by supplying malicious input to the setGetter() function. A proof of concept demonstrates that an attacker can pollute the Object prototype by setting a 'proto.polluted' property, which then affects all objects in the application (WhiteSource DB).

Users should upgrade to version 0.1.1 of the set-getter package which contains the fix for this vulnerability (WhiteSource DB).