Starcounter-Jack JSON-Patch Prototype Pollution vulnerability

CRITICO 9.8CVE-2021-4279 · GHSA-8gh8-hqwg-xf34 · Published 25/12/2022 · updated 17/06/2026

In breve

CVE-2021-4279 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda json-patch (starcounter-jack), fast-json-patch.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.2%, superiore al 67.3% delle vulnerabilità.
Correzione: aggiornare a 3.1.1 o successiva.

Package	Affected versions	Patched versions
json-patch starcounter-jack	`< 3.1.1`	`3.1.1`
fast-json-patch npm	`< 3.1.1`	`3.1.1`

Description

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

NVD description

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2021-4279 · ADVISORY
Starcounter-Jack/JSON-Patch#262 · WEB
Starcounter-Jack/JSON-Patch commit 7ad6af4 · WEB
blog.effectrenan.com/pwn2win-2021-illusion-web-challenge · WEB
Starcounter-Jack/JSON-Patch · PACKAGE
Starcounter-Jack/JSON-Patch release 3.1.1 · WEB
vuldb.com · WEB
vuldb.com · WEB
huntr.dev/bounties/1-npm-fast-json-patch · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

json-patch

starcounter-jack

< 3.1.1

3.1.1

fast-json-patch

npm

< 3.1.1

3.1.1

Description

NVD description

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.