| Package | Affected versions | Patched versions |
|---|---|---|
| json | ≥ 2.14.0, < 2.15.2.1≥ 2.16.0, < 2.17.1.2≥ 2.18.0, < 2.19.2 | 2.15.2.12.17.1.22.19.2 |
| json | ≥ 2.14.0, < 2.15.2.1≥ 2.16.0, < 2.17.1.2≥ 2.18.0, < 2.19.2 | 2.15.2.12.17.1.22.19.2 |
A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.
This option isn't the default, if you didn't opt-in to use it, you are not impacted.
Patched in 2.19.2.
The issue can be avoided by not using the allow_duplicate_key: false parsing option.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free