CVE-2024-21529 describes a prototype pollution vulnerability in the dset package affecting all versions prior to 3.1.4. The vulnerability arises from improper sanitization of user input in the dset function, enabling attackers to inject malicious properties using the built-in Object property __proto__. This injection recursively affects all objects in the program, which can lead to unexpected behavior or security issues. The CVSS 4.0 base score is 8.8, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on integrity.

Successful exploitation allows an attacker to manipulate the prototype of base objects, potentially altering application logic or causing security bypasses. This can lead to integrity violations in the affected application. No known exploits in the wild have been reported at this time.

No official patch or remediation level has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of dset or apply manual input validation to prevent injection of __proto__ properties.