8 matches found
CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution
A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...
1-0-5-hai-aage-dekhte-hein-kya-aat-hai (>=1.0.5, <=1.0.6), 1shot (>=0.0.1, <=0.0.2) +8285 more potentially affected by CVE-2026-15195 via @apidevtools/json-schema-ref-parser (>=8.0.0, <=15.3.5)
@apidevtools/json-schema-ref-parser NPM version =8.0.0, =1.0.5, =0.0.1, =0.1.1, =0.0.1-251008.90016, =2.0.1, =1.0.0, =1.3.0, =0.0.53, =0.0.31, =3.11.3, =1.0.0, =1.0.0, =1.1.1-pr-7-1d68cf28da, =2.13.2 and more Source cves: CVE-2026-15195 Source advisory: MEND:CVE-2026-15195...
CVE-2026-15195: Improperly Controlled Modification of Object Prototype Attributes
A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...
CVE-2026-39885
FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenA...
CVE-2026-39885: Server-Side Request Forgery (SSRF)
FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenA...
@aipmorg/lint (1.23.4), @arietta-studio/lint (>=1.0.0, <=1.2.0) +30 more potentially affected by CVE-2024-29651 via @apidevtools/json-schema-ref-parser (11.1.0)
@apidevtools/json-schema-ref-parser NPM version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apidevtools/json-schema-ref-parser and may be impacted: - @aipmorg/lint 1.23.4 - @arietta-studio/lint =1.0.0, =0.0.0-alpha.7, =0.0.0-alpha.7,...
@aipmorg/lint (1.23.4), @arietta-studio/lint (>=1.0.0, <=1.2.0) +30 more potentially affected by CVE-2024-29651 via @apidevtools/json-schema-ref-parser (11.1.0)
@apidevtools/json-schema-ref-parser NPM version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apidevtools/json-schema-ref-parser and may be impacted: - @aipmorg/lint 1.23.4 - @arietta-studio/lint =1.0.0, =0.0.0-alpha.7, =0.0.0-alpha.7,...
@aipmorg/lint (1.23.4), @arietta-studio/lint (>=1.0.0, <=1.2.0) +30 more potentially affected by CVE-2024-29651 via @apidevtools/json-schema-ref-parser (11.1.0)
@apidevtools/json-schema-ref-parser NPM version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @apidevtools/json-schema-ref-parser and may be impacted: - @aipmorg/lint 1.23.4 - @arietta-studio/lint =1.0.0, =0.0.0-alpha.7, =0.0.0-alpha.7,...