This affects the package set-value before 2.0.1, and starting with 3.0.0 but prior to 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays. (#16228)
This affects the package set-value before 2.0.1, and starting with 3.0.0 but prior to 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays. (#16228)

Co-authored-by: Andrii Kozin <4614137e1933f08993a5f91e075a0e0fdfc2be28@gmail.com>
Microsoft/vso-agent-tasks,Microsoft/vso-agent-tasks,Microsoft/vso-agent-tasks