Executive brief
json8-merge-patch is a JavaScript library that merges JSON objects according to RFC 6902 specifications. A prototype pollution vulnerability allows attackers to inject or modify properties of JavaScript's global object constructor without authentication, potentially leading to application malfunction, data manipulation, or code execution depending on how the library is used.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in json8-merge-patch versions before 1.0.3. The merge-patch implementation fails to properly validate and sanitize input, allowing attackers to craft malicious JSON payloads that inject properties into the Object prototype. This is a network-exploitable vulnerability (no authentication required, no user interaction needed). An attacker who can control input to the merge-patch function can modify global object properties, potentially affecting all downstream code relying on those properties. The fix is available in version 1.0.3 and later.
Affected products
- npm json8-merge-patch < 1.0.3
Timeline
- 2020-09-12: disclosed: Vulnerability reported on GitHub
- 2021-05-10: advisory: GHSA published
- 2020-11-09: patched: Fix released in version 1.0.3