CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

CVE-2026-15195

The CVE affects the apidevtools json-schema-ref-parser package up to version 15.3.5. The vulnerability targets the Refs.set/Pointer.set paths in lib/pointer.ts, enabling remote modification of object prototype attributes (prototype pollution) as described. Impact is described as remote exploitati...

CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

1-0-5-hai-aage-dekhte-hein-kya-aat-hai (>=1.0.5, <=1.0.6), 1shot (>=0.0.1, <=0.0.2) +8285 more potentially affected by CVE-2026-15195 via @apidevtools/json-schema-ref-parser (>=8.0.0, <=15.3.5)

@apidevtools/json-schema-ref-parser NPM version =8.0.0, =1.0.5, =0.0.1, =0.1.1, =0.0.1-251008.90016, =2.0.1, =1.0.0, =1.3.0, =0.0.53, =0.0.31, =3.11.3, =1.0.0, =1.0.0, =1.1.1-pr-7-1d68cf28da, =2.13.2 and more Source cves: CVE-2026-15195 Source advisory: MEND:CVE-2026-15195...

CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

PT-2026-56889

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

CVE-2026-15195: Improperly Controlled Modification of Object Prototype Attributes

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

CVE-2026-39885

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenA...

CVE-2026-39885: Server-Side Request Forgery (SSRF)

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenA...

actscene-ocr (>=0.1.3, <=0.1.5), alexandria-tui (>=0.1.0, <=0.2.0) +136 more potentially affected by CVE-2026-32874 via ujson (>=5.4.0, <=5.11.0)

ujson PYPI version =5.4.0, =0.1.3, =0.1.0, =1.3.12, =1.0.5, =0.1.0a2, =0.0.1, =2.2.0, =6.2.0.dev68, =0.1.21, =0.3.9, =0.1.0a1, =0.1.0, =12.1.0, =12.4.0 and more Source cves: CVE-2026-32874 Source advisory: MEND:CVE-2026-32874...

actscene-ocr (>=0.1.3, <=0.1.5), alexandria-tui (>=0.1.0, <=0.2.0) +136 more potentially affected by CVE-2026-32874 via ujson (>=5.4.0, <=5.11.0)

ujson PYPI version =5.4.0, =0.1.3, =0.1.0, =1.3.12, =1.0.5, =0.1.0a2, =0.0.1, =2.2.0, =6.2.0.dev68, =0.1.21, =0.3.9, =0.1.0a1, =0.1.0, =12.1.0, =12.4.0 and more Source cves: CVE-2026-32874 Source advisory: OSV:GHSA-WGVC-GHV9-3PMM...

Malicious code in apidevtools (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9504 Malicious code in apidevtools (npm)

--- -= Per source details. Do not edit below this line.=-...

@aipmorg/lint (1.23.4), @arietta-studio/lint (>=1.0.0, <=1.2.0) +30 more potentially affected by CVE-2024-29651 via @apidevtools/json-schema-ref-parser (11.1.0)

@apidevtools/json-schema-ref-parser NPM version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apidevtools/json-schema-ref-parser and may be impacted: - @aipmorg/lint 1.23.4 - @arietta-studio/lint =1.0.0, =0.0.0-alpha.7, =0.0.0-alpha.7,...

@aipmorg/lint (1.23.4), @arietta-studio/lint (>=1.0.0, <=1.2.0) +30 more potentially affected by CVE-2024-29651 via @apidevtools/json-schema-ref-parser (11.1.0)

@apidevtools/json-schema-ref-parser NPM version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apidevtools/json-schema-ref-parser and may be impacted: - @aipmorg/lint 1.23.4 - @arietta-studio/lint =1.0.0, =0.0.0-alpha.7, =0.0.0-alpha.7,...

@aipmorg/lint (1.23.4), @arietta-studio/lint (>=1.0.0, <=1.2.0) +30 more potentially affected by CVE-2024-29651 via @apidevtools/json-schema-ref-parser (11.1.0)

@apidevtools/json-schema-ref-parser NPM version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apidevtools/json-schema-ref-parser and may be impacted: - @aipmorg/lint 1.23.4 - @arietta-studio/lint =1.0.0, =0.0.0-alpha.7, =0.0.0-alpha.7,...