Code injection

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited...

GHSA-P5G9-RJCF-95VJ fastest-json-copy vulnerable to Prototype Pollution

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the proto property to be edited...

CVE-2022-42743 deep-parse-json 1.0.2 - Prototype Pollution

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...

Algolia: Stored XSS triggered by json key during UI generation

Stored XSS is triggred from Indices - Generate a UI Demo. Typing anything in the Primary, Secondary, Tertiary, Image or URL attributes for User Interface section. These text box have a drop down which displays the json keys during which XSS is triggered. Sample json for XSS would be "": "hello",...