Lucene search

Veracode Vulnerability DatabaseVERACODE:47114

HistoryMay 22, 2024 - 8:23 a.m.

Prototype Pollution

2024-05-2208:23:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

prototype pollution

json-schema-ref-parser

inadequate input validation

remote attacker

execute arbitrary code

vulnerability

7.5 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

@apidevtools/json-schema-ref-parser is vulnerable to Prototype Pollution. The vulnerability is due to inadequate input validation in the bundle(), parse(), resolve(), and dereference() functions, allowing a remote attacker to execute arbitrary code.

CPENameOperatorVersion
@apidevtools/json-schema-ref-parserle11.1.0
@apidevtools/json-schema-ref-parserle11.1.0

CPE	Name	Operator	Version
	@apidevtools/json-schema-ref-parser	le	11.1.0
	@apidevtools/json-schema-ref-parser	le	11.1.0

References

gist.github.com/tariqhawis/5db76b38112bba756615b688c32409ad

github.com/advisories/GHSA-5f97-h2c2-826q

github.com/APIDevTools/json-schema-ref-parser/commit/8cad7f72c15b198f4d0b5b1c8a3a979b2e4baa82