high8.1
CVE-2024-29651
json-schema-ref-parser Prototype Pollution issue
Impact
A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the `bundle()`, `parse()`, `resolve()`, `dereference()` functions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @apidevtools/json-schema-ref-parser | >= 11.0.0, <= 11.1.0 | 11.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/tariqhawis/5db76b38112bba756615b688c32409ad
- https://github.com/advisories/GHSA-5f97-h2c2-826q
- https://nvd.nist.gov/vuln/detail/CVE-2024-29651
- https://github.com/APIDevTools/json-schema-ref-parser/commit/8cad7f72c15b198f4d0b5b1c8a3a979b2e4baa82