CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-7766
Critical (9.8) in json-ptr project json-ptr. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in json-ptr 2.1.0.
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- json-ptr_project:json-ptr
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x5r6-x823-9848 | npm | json-ptr | <2.1.0 | 2.1.0 |