MediumGHSA-v88g-cgmw-v5xwCVE-2020-15366
Prototype Pollution in Ajv
Published 10 Feb 2022 · Updated 21 Jun 2024
Affected package
ajvnpm
- Affected
- <6.12.3
- Fixed in
- 6.12.3
Update to the fixed version for your release line, for example:
npm install ajv@6.12.3Details
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Is GHSA-v88g-cgmw-v5xw in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected ajv, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2020-15366
- Linkgithub.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f
- Packagegithub.com/ajv-validator/ajv
- Linkgithub.com/ajv-validator/ajv/releases/tag/v6.12.3
- Linkgithub.com/ajv-validator/ajv/tags
- Linkhackerone.com/bugs?subject=user&report_id=894259
- Linksecurity.netapp.com/advisory/ntap-20240621-0007
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.