GitHub Advisoryadvisory · npm

GHSA-ff9j-pwxg-q5p2 deep-parse-json vulnerable to Prototype Pollution

MEDIUM Published 2022-11-04 Modified 2022-11-08 Official page ↗
Aliases
CVE-2022-42743
Ecosystem
npm
Packages
deep-parse-json
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2022-11-08

Affected packages

• npm deep-parse-json: <= 1.0.2 (no fix yet)

Description

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the `__proto__` property to be edited.

Related

Alias · CVE (1)

  • CVE-2022-42743 deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References