CVE-2021-3918 — Prototype Pollution in Project Json-schema

CWE-1321 — Prototype PollutionCWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes9 documents7 sources
Severity
9.8CRITICALNVD
EPSS
1.3%
top 20.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Json-schema Project Json-schemaDebian Node-json-schemaKriszyp Json-schema+1 more
Timeline
PublishedNov 13
Latest updateMay 24

Description

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/node-json-schema< node-json-schema 0.4.0+~7.0.9-1 (bookworm)
▶CVEListV5kriszyp/kriszyp_json-schemaunspecified — 0.3.0

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: huntr.dev ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
json-schema is vulnerable to Prototype Pollution↗2021-11-19
▶
GHSA
json-schema is vulnerable to Prototype Pollution↗2021-11-19
▶
OSV
CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')↗2021-11-13
▶

📋Vendor Advisories

5
Ubuntu
JSON Schema vulnerability↗2023-05-24
▶
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Chatbot Framework (JSON Schema) — CVE-2021-3918↗2023-01-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: REST API (json-schema) — CVE-2021-3918↗2022-10-15
▶
Red Hat
nodejs-json-schema: Prototype pollution vulnerability↗2021-10-03
▶
Debian
CVE-2021-3918: node-json-schema - json-schema is vulnerable to Improperly Controlled Modification of Object Protot...↗2021
▶