JSON5 vulnerability

2024-04-3000:00:00

ubuntu.com

json5

parse method

ubuntu 22.04

ubuntu 20.04

ubuntu 18.04

node-json5

denial of service

network services

7.8 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

77.8%

JSON

Releases

Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM

Packages

node-json5 - JSON for the ES5 era

Details

It was discovered that the JSON5 parse method incorrectly handled the parsing
of keys named proto. An attacker could possibly use this issue to pollute
the prototype of the returned object, setting arbitrary or unexpected keys, and
cause a denial of service, allow unintended access to network services or have
other unspecified impact, depending on the application’s use of the module.

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchnode-json5< 2.2.0+dfsg-1ubuntu0.1~esm1UNKNOWN
Ubuntu22.04noarchnode-json5< 2.2.0+dfsg-1UNKNOWN
Ubuntu20.04noarchnode-json5< 0.5.1-3ubuntu0.1UNKNOWN
Ubuntu18.04noarchnode-json5< 0.5.1-1ubuntu0.1~esm1UNKNOWN
Ubuntu18.04noarchnode-json5< 0.5.1-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	22.04	noarch	node-json5	< 2.2.0+dfsg-1ubuntu0.1~esm1	UNKNOWN
Ubuntu	22.04	noarch	node-json5	< 2.2.0+dfsg-1	UNKNOWN
Ubuntu	20.04	noarch	node-json5	< 0.5.1-3ubuntu0.1	UNKNOWN
Ubuntu	18.04	noarch	node-json5	< 0.5.1-1ubuntu0.1~esm1	UNKNOWN
Ubuntu	18.04	noarch	node-json5	< 0.5.1-1	UNKNOWN