Vulnerability version 3.1.3

Nobody has claimed this yet.

Identifiers
[pkg:npm/dset@3.1.3](https://ossindex.sonatype.org/component/pkg:npm/dset@3.1.3?utm_source=dependency-check&utm_medium=integration&utm_content=8.2.1) (Confidence:Highest)
[cpe:2.3:a:dset_project:dset:3.1.3:*:*:*:*:*:*:*](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Adset_project&cpe_product=cpe%3A%2F%3Adset_project%3Adset&cpe_version=cpe%3A%2F%3Adset_project%3Adset%3A3.1.3) (Confidence:Highest)
Published Vulnerabilities
[CVE-2022-25645](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-25645)

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSSv2:
Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSSv3:
Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References:
MISC - https://github.com/lukeed/dset/blob/master/src/merge.js%23L9
MISC - https://github.com/lukeed/dset/pull/38
MISC - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974
MISC - https://snyk.io/vuln/SNYK-JS-DSET-2330881
Vulnerable Software & Versions:

[cpe:2.3:a:dset_project:dset:*:*:*:*:*:node.js:*:*](https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Adset_project%3Adset%3A%3A%3A%7E%7E%7Enode.js%7E%7E)

Identifiers
[pkg:npm/dset@3.1.3](https://ossindex.sonatype.org/component/pkg:npm/dset@3.1.3?utm_source=dependency-check&utm_medium=integration&utm_content=8.2.1) (Confidence:Highest)
[cpe:2.3:a:dset_project:dset:3.1.3:*:*:*:*:*:*:*](https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Adset_project&cpe_product=cpe%3A%2F%3Adset_project%3Adset&cpe_version=cpe%3A%2F%3Adset_project%3Adset%3A3.1.3) (Confidence:Highest)
Published Vulnerabilities
[CVE-2022-25645](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-25645)

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSSv2:
Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSSv3:
Base Score: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References:
MISC - https://github.com/lukeed/dset/blob/master/src/merge.js%23L9
MISC - https://github.com/lukeed/dset/pull/38
MISC - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974
MISC - https://snyk.io/vuln/SNYK-JS-DSET-2330881
Vulnerable Software & Versions:

[cpe:2.3:a:dset_project:dset:*:*:*:*:*:node.js:*:*](https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=cpe%3A%2Fa%3Adset_project%3Adset%3A%3A%3A%7E%7E%7Enode.js%7E%7E)

Start by reading src/merge.js at the referenced line and the package's existing tests, focusing on the dset/merge path and the CVE-2022-25645 description. Confirm how crafted objects can bypass the current checks, then add coverage and ensure prototype pollution is prevented without breaking valid deep writes.

Written by the indexing model from the issue text.