GoogleOSV:GHSA-5F97-H2C2-826Q

HistoryMay 20, 2024 - 6:31 p.m.

json-schema-ref-parser Prototype Pollution issue

2024-05-2018:31:23

Google

osv.dev

api dev tools

remote attacker

arbitrary code

bundle

parse

resolve

dereference

software

7.8 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle(), parse(), resolve(), dereference() functions.

CPENameOperatorVersion
@apidevtools/json-schema-ref-parserge11.0.0
@apidevtools/json-schema-ref-parserlt11.2.0

CPE	Name	Operator	Version
	@apidevtools/json-schema-ref-parser	ge	11.0.0
	@apidevtools/json-schema-ref-parser	lt	11.2.0

References

gist.github.com/tariqhawis/5db76b38112bba756615b688c32409ad

github.com/APIDevTools/json-schema-ref-parser

github.com/APIDevTools/json-schema-ref-parser/commit/8cad7f72c15b198f4d0b5b1c8a3a979b2e4baa82

nvd.nist.gov/vuln/detail/CVE-2024-29651