CVE-2021-23509

CVE-2021-23509 affects the json-ptr package prior to 3.0.0. The vulnerability is described as a type confusion in the pointer parameter that can be triggered by user-provided keys, potentially enabling a bypass of CVE-2020-7766 when those keys are arrays. Related advisories (GHSA, osv, NVD entrie...

CVE-2020-7766

The CVE-2020-7766 issue affects the json-ptr package and is triggered in the set operation when the force flag is true. The vulnerable path recursively sets properties on the target object but does not adequately validate the key, enabling prototype pollution. Affected versions are before 3.0.0, ...