Executive brief
schema-inspector is a JavaScript library used to validate and sanitize data objects in applications. A malicious attacker can craft specially-formed objects that bypass the library's sanitize() and validate() functions, potentially allowing invalid or malicious data to pass through security checks and reach application logic, compromising data integrity and application behavior.
Technical details
schema-inspector contains a validation bypass vulnerability (CWE-668: Improper Initialization) in versions before 1.6.9 where a specially-crafted JavaScript object can circumvent both the sanitize() and validate() functions. The vulnerability does not require authentication or user interaction—an attacker with the ability to supply input objects to the affected functions can exploit it directly. This allows malicious data to bypass intended validation rules and reach application logic, potentially leading to data manipulation, injection attacks, or other downstream compromise depending on how the validated data is used. The vulnerability was fixed in version 1.6.9 via commit 345a7b2.
Affected products
- schema-inspector schema-inspector before 1.6.9
Timeline
- 2020-06-10: disclosed
- 2020-06-10: patched: Version 1.6.9 released with fix