Executive brief
jpv (Json Pattern Validator) is a JavaScript library used to validate JSON data against defined patterns. A validation bypass flaw allows attackers to submit malformed JSON data that should be rejected but instead passes validation, potentially allowing invalid or malicious data to be processed by applications relying on the library.
Technical details
jpv before version 2.2.2 contains an input validation bypass in its JSON pattern validation logic, specifically when processing array structures (CWE-20). The vulnerability allows specially crafted or corrupted JSON arrays to bypass validation checks that should reject them. The flaw is reachable over the network when the library is used in server-side applications, with no authentication required. An attacker can craft malicious JSON payloads to circumvent validation rules, potentially enabling injection attacks or data integrity violations. The fix is available in version 2.2.2 and later.
Affected products
- jpv jpv before 2.2.2
Timeline
- 2020-08-10: disclosed
- 2020: patched: Version 2.2.2 released with fix
- 2021-05-06: advisory: GHSA-vh6r-g38f-q3w8 published