GHSA-7mg4-w3w5-x5pc
Prototype pollution in json-pointer
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | json-pointer | < 0.6.1 | 0.6.1 |
| Maven | org.webjars.npm:json-pointer | < 0.6.1 | 0.6.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-7709
- https://github.com/manuelstofer/json-pointer/pull/34
- https://github.com/manuelstofer/json-pointer/pull/34/files
- https://github.com/manuelstofer/json-pointer
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-598862
- https://snyk.io/vuln/SNYK-JS-JSONPOINTER-596925
- https://www.npmjs.com/package/json-pointer