GHSA-v88g-cgmw-v5xw

    Dashboard / Vulnerabilities / GHSA-v88g-cgmw-v5xw

    GHSA-v88g-cgmw-v5xw

    Published: 10 Feb 2022Last Modified: 21 Jun 2024

    Summary: Prototype Pollution in Ajv

    Details: An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-15366, https://github.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f, https://github.com/ajv-validator/ajv, https://github.com/ajv-validator/ajv/releases/tag/v6.12.3, https://github.com/ajv-validator/ajv/tags, https://hackerone.com/bugs?subject=user&report_id=894259, https://security.netapp.com/advisory/ntap-20240621-0007

    Affected packages

    Package

    Name: ajv

    Purl: pkg:npm/ajv

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -6.12.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-v88g-cgmw-v5xw | CVE-DB