CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2019-19507
Medium (5.3) in json pattern validator project json pattern validator. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in jpv 2.1.1.
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- json_pattern_validator_project:json_pattern_validator
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rh46-3fgc-mvrf | npm | jpv | <2.1.1 | 2.1.1 |