요약
- CVE-2020-7766은(는) json-ptr (json-ptr project), json-ptr에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.9%, 전체 취약점의 79.8%보다 높음.
- 조치: 2.0.0, 2.1.0 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| json-ptr | < 2.0.0
| 2.0.0
|
| json-ptr npm | < 2.1.0
| 2.1.0
|
Description
npm json-ptr before 2.1.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
NVD description
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free