GitHub Advisoryadvisory · npm

GHSA-7h43-gx24-p529 Prototype pollution in json8

CRITICAL Published 2021-05-10 Modified 2021-04-19 Official page ↗
Aliases
CVE-2020-7770
Ecosystem
npm
Packages
json8
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2021-04-19

Affected packages

• npm json8: < 1.0.3 → fixed in 1.0.3

Description

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

Related

Alias · CVE (1)

  • CVE-2020-7770 This affects the package json8 before 1.0.3. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References