~ / search / GHSA-7h43-gx24-p529

GHSA-7h43-gx24-p529

Prototype pollution in json8

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7770

Packages

EcosystemPackageAffectedFixed in
npm json8 < 1.0.3 1.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

References

External links from the advisory. They lead to third-party sites.