Executive brief
Ajv is a popular JSON Schema validator library used to validate data against schemas. A specially crafted JSON schema can trigger prototype pollution, potentially allowing an attacker to modify JavaScript object properties and execute arbitrary code, though the risk is limited to scenarios where untrusted schemas are processed.
Technical details
A prototype pollution vulnerability exists in Ajv's validate() function when processing malicious JSON schemas. The root cause is insufficient validation of numeric values in schemas during compilation, allowing an attacker to pollute the JavaScript prototype chain. The attack requires submission of an untrusted schema to the validator; no network interaction or authentication bypass is needed, but the attacker must control the schema input. Successful exploitation can lead to code execution or denial of service. The vulnerability is fixed in version 6.12.3 and later.
Affected products
- Ajv Ajv before 6.12.3
Timeline
- 2022-02-10: disclosed
- 2020: patched: Fixed in version 6.12.3