CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2020-8268
High (7.5) in json8-merge-patch project json8-merge-patch. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in json8-merge-patch 1.0.3.
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-471
- Published
- Modified
- Record from
- the NVD, synced
Affected
- json8-merge-patch_project:json8-merge-patch
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8v9x-9xqg-r8mr | npm | json8-merge-patch | <1.0.3 | 1.0.3 |