high7.5
CVE-2020-8268
Prototype pollution in json8-merge-patch
Impact
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | json8-merge-patch | < 1.0.3 | 1.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Json8-Merge-Patch Project | Json8-Merge-Patch | before 1.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://hackerone.com/reports/980649
- https://github.com/advisories/GHSA-8v9x-9xqg-r8mr
- https://nvd.nist.gov/vuln/detail/CVE-2020-8268
- https://github.com/sonnyp/JSON8/issues/113
- https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e#diff-faa7bef039022bc7ca1c613331b2373950ddd3d65ebf25d1699fbdf89773a387
- https://www.npmjs.com/package/json8-merge-patch