Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mZjlqLXB3eGctcTVwMs4AAvsz

deep-parse-json vulnerable to Prototype Pollution

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the __proto__ property to be edited.

Permalink: https://github.com/advisories/GHSA-ff9j-pwxg-q5p2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZjlqLXB3eGctcTVwMs4AAvsz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Identifiers: GHSA-ff9j-pwxg-q5p2, CVE-2022-42743
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-42743
• https://fluidattacks.com/advisories/buuren/
• https://github.com/sibu-github/deep-parse-json/issues/6
• https://github.com/advisories/GHSA-ff9j-pwxg-q5p2

Repository: https://github.com/sibu-github/deep-parse-json
Blast Radius: 7.4

Affected Packages