Exploit for CVE-2026-26021
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1, < 2.0.5). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.
Published: 2026-02-11
CVSS: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Download Exploit for CVE-2026-26021 here:
Tip: Download official Tor Browser at https://www.torproject.org/download/ to access .onion links.
Check our portfolio:
https://veletacapital.com/exploit-598-cve-2026-2795/
https://veletacapital.com/exploit-194-cve-2026-2183/
https://veletacapital.com/exploit-694-cve-2026-27510/
