Prototype Pollution

2023-01-0507:22:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

128

json5 vulnerability

prototype pollution

internalize function

parse.js

restrict keys

attacker injection

crafted strings

0.006 Low

EPSS

Percentile

77.9%

JSON

json5 is vulnerable to prototype pollution. The vulnerability exists in the internalize function in parse.js due to not restricting keys named __proto__ which allows an attacker to inject specially crafted strings to pollute the prototype of the resulting object.

CPENameOperatorVersion
json5le1.0.1
json5le2.2.1
node-json5:sideq2.1.3-2
node-json5:bookwormeq2.1.3-2
mozjs60eq60.9.0__3.el8
mozjs60eq60.9.0__4.el8
389-ds-baseeq1.4.3.28__6.module_el8.6.0+1102+fe5d910f
389-ds-baseeq1.4.3.23__2.module_el8.5.0+835+5d54734c
389-ds-baseeq2.0.10__1.module_el8+13165+e48f98fd
389-ds-baseeq1.4.3.16__16.module_el8.4.0+845+0c39e1b7

Name	Operator	Version
json5	le	1.0.1
json5	le	2.2.1
node-json5:sid	eq	2.1.3-2
node-json5:bookworm	eq	2.1.3-2
mozjs60	eq	60.9.0__3.el8
mozjs60	eq	60.9.0__4.el8
389-ds-base	eq	1.4.3.28__6.module_el8.6.0+1102+fe5d910f
389-ds-base	eq	1.4.3.23__2.module_el8.5.0+835+5d54734c
389-ds-base	eq	2.0.10__1.module_el8+13165+e48f98fd
389-ds-base	eq	1.4.3.16__16.module_el8.4.0+845+0c39e1b7