~ / search / GHSA-v88g-cgmw-v5xw

GHSA-v88g-cgmw-v5xw

Prototype Pollution in Ajv

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15366

Packages

EcosystemPackageAffectedFixed in
npm ajv < 6.12.3 6.12.3

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

References

External links from the advisory. They lead to third-party sites.