Security readout for executives and security teams
Plain-English summary
CVE-2020-28267 affects the npm package @strikeentco/set version 1.0.0. The reported issue is prototype pollution, where unsafe object-setting behavior can corrupt shared JavaScript object behavior. Public sources state this can cause denial of service and may lead to remote code execution, but they do not provide CVSS scoring or confirmed exploitation.
Executive priority
Treat as a targeted dependency risk rather than an internet-wide emergency. Prioritize applications using this package in request-handling, API, or data-ingestion paths, especially where untrusted input shapes object properties.
Technical view
The vulnerable component is @strikeentco/set 1.0.0. The CVE describes prototype pollution in object property assignment. Exposure depends on whether attacker-controlled input can influence keys, paths, or objects passed into the package. The source bundle references an upstream GitHub commit, but does not name a fixed release.
Likely exposure
Likely exposure is limited to JavaScript or Node.js applications that directly or transitively include @strikeentco/set 1.0.0 and pass untrusted input into its object-setting functionality.
Exploitation context
CISA KEV is false, and the provided sources do not show active exploitation. The CVE states denial of service is possible and remote code execution may be possible, but exploit conditions are not detailed in the bundle.
Researcher notes
Evidence is sparse: no CVSS, CWE, fixed version, or exploit details are provided. Analysis should focus on dependency presence, call-site reachability, and whether attacker-controlled property names or paths flow into @strikeentco/set.
Mitigation direction
- Inventory direct and transitive use of @strikeentco/set version 1.0.0.
- Review upstream vendor guidance and the referenced commit for fixed behavior.
- If no maintained fix exists, remove or replace the package.
- Avoid passing untrusted keys, paths, or objects into setter utilities.
- Add dependency scanning rules for this package and version.
Validation and detection
- Check package manifests and lockfiles for @strikeentco/set 1.0.0.
- Review dependency trees for transitive inclusion of the affected package.
- Trace whether external input can reach calls using this library.
- Confirm SCA tooling flags CVE-2020-28267 where the package is present.
- Verify remediation by confirming the vulnerable version is absent.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-28267 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/strikeentco/set/commit/102cc6b2e1d1e0c928ced87e75df759d5541ff60CVE reference · x_refsource_MISC
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28267CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.