trentm/json vulnerable to command injection

HIGH 7.2CVE-2020-7712 · GHSA-3c6g-pvg8-gqw2 · Published 30/08/2020 · updated 08/10/2026

In short

CVE-2020-7712 is a HIGH (CVSS 7.2) vulnerability affecting org.webjars.npm:json, json (joyent), commerce guided search (oracle).
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.8% of all vulnerabilities.
Fix: update to 10.0.0, 21.1.1.1.0 or later.

Package	Affected versions	Patched versions
org.webjars.npm:json Maven	`≤ 9.0.6`	No fix yet
json joyent	`< 10.0.0`	`10.0.0`
commerce guided search oracle	`= 11.3.2`	No fix yet
financial services crime and compliance management studio oracle	`= 8.0.8.2.0= 8.0.8.3.0`	No fix yet
financial services regulatory reporting with agilereporter oracle	`= 8.0.9.6.3`	No fix yet
timesten in-memory database oracle	`< 21.1.1.1.0`	`21.1.1.1.0`
json npm	`< 10.0.0`	`10.0.0`

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

NVD description

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.