High, CVSS 7.1npmAmendedPublished
Prototype Pollution in JSON5 via Parse Method
CVE-2022-46175 · GHSA-9c47-m6qq-7p4h
- Affected
- npm json5 >= 2.0.0, < 2.2.2; < 1.0.2
- Fixed in
- 1.0.22.2.2· Vendor fix available
- Issue
- The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. Impact This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. Mitigation This vulnerability is patched in json5 v2.2.2 and later. A patch has…
Recommended action: Upgrade to 2.2.2 or 1.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.