CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-7770
Critical (9.8) in json8 project json8. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in json8 1.0.3.
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- json8_project:json8
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7h43-gx24-p529 | npm | json8 | <1.0.3 | 1.0.3 |