Lucene search

K
osvGoogleOSV:GHSA-RH46-3FGC-MVRF
HistoryDec 04, 2019 - 9:25 p.m.

Validation bypass is possible in Json Pattern Validator

2019-12-0421:25:28
Google
osv.dev
9

0.001 Low

EPSS

Percentile

45.5%

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by ‘constructor’: {‘name’:‘Array’}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

CPENameOperatorVersion
jpvlt2.1.1

0.001 Low

EPSS

Percentile

45.5%

Related for OSV:GHSA-RH46-3FGC-MVRF