@datastream/validate (>=0.1.4, <=0.7.0), @lukoweb/apitogo (>=0.1.0, <=0.1.72) +9 more potentially affected by CVE-2026-15195 via @apidevtools/json-schema-ref-parser (>=15.1.1, <=15.3.5)

@apidevtools/json-schema-ref-parser NPM version =15.1.1, =0.1.4, =0.1.0, =0.1.26, =0.12.0, =0.8.2, =1.0.4, =2.12.0, =3.1.1-alpha-1765531917303-eb0309c.0, =1.0.0, =1.5.15, =0.0.0-chore-migrate-to-snippetz.zccff2a2a, =0.82.4 Source cves: CVE-2026-15195 Source advisory:...

CVE-2026-15195

The CVE affects the apidevtools json-schema-ref-parser package up to version 15.3.5. The vulnerability targets the Refs.set/Pointer.set paths in lib/pointer.ts, enabling remote modification of object prototype attributes (prototype pollution) as described. Impact is described as remote exploitati...

CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...