GHSA-v5vg-g7rq-363w

Prototype Pollution in json-pointer

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23820

Packages

Ecosystem	Package	Affected	Fixed in
npm	json-pointer	< 0.6.2	0.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

This affects versions of package `json-pointer` up to and including `0.6.1`. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23820 advisory
https://github.com/manuelstofer/json-pointer/pull/36 web
https://github.com/manuelstofer/json-pointer/commit/931b0f9c7178ca09778087b4b0ac7e4f505620c2 web
https://github.com/manuelstofer/json-pointer package
https://github.com/manuelstofer/json-pointer/blob/master/index.js%23L78 web
https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577287 web