GHSA-282f-qqgm-c34q

Prototype Pollution in node-jsonpointer

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23807

Packages

Ecosystem	Package	Affected	Fixed in
npm	jsonpointer	< 5.0.0	5.0.0
npm	org.webjars.npm:json-pointer	< 5.0.0	5.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package `jsonpointer` before `5.0.0`. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23807 advisory
https://github.com/janl/node-jsonpointer/pull/51 web
https://github.com/janl/node-jsonpointer/commit/a0345f3550cd9c4d89f33b126390202b89510ad4 web
https://github.com/janl/node-jsonpointer package
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273 web
https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288 web