Lucene search

GitHub Advisory DatabaseGHSA-5F97-H2C2-826Q

HistoryMay 20, 2024 - 6:31 p.m.

json-schema-ref-parser Prototype Pollution issue

2024-05-2018:31:23

CWE-1321

GitHub Advisory Database

github.com

api dev tools

remote code execution

bundle

parse

resolve

dereference

software

8.1 High

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle(), parse(), resolve(), dereference() functions.

Affected configurations

Vulners

Node

apidevtoolsjson-schema-ref-parserRange≤11.1.0

CPENameOperatorVersion
@apidevtools/json-schema-ref-parserle11.1.0

CPE	Name	Operator	Version
	@apidevtools/json-schema-ref-parser	le	11.1.0

References

gist.github.com/tariqhawis/5db76b38112bba756615b688c32409ad

github.com/advisories/GHSA-5f97-h2c2-826q

github.com/APIDevTools/json-schema-ref-parser/commit/8cad7f72c15b198f4d0b5b1c8a3a979b2e4baa82

nvd.nist.gov/vuln/detail/CVE-2024-29651