GitHub Advisoryadvisory · npm

GHSA-x5r6-x823-9848 Arbitrary Code Execution in json-ptr

HIGH Published 2021-05-10 Modified 2023-09-05 Official page ↗
Aliases
CVE-2020-7766
Ecosystem
npm
Packages
json-ptr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321, CWE-400, CWE-74
Reviewed
2021-04-19

Affected packages

• npm json-ptr: < 2.1.0 → fixed in 2.1.0

Description

npm `json-ptr` before 2.1.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

Related

Alias · CVE (1)

  • CVE-2020-7766 This affects all versions of package json-ptr. vulnerability

Weakness · CWE (3)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References