Executive brief
json-schema is a JavaScript library used to validate data structures against JSON Schema definitions. A prototype pollution vulnerability allows attackers to modify the global JavaScript object prototype, potentially poisoning all objects in an application and enabling arbitrary code execution or data manipulation across the entire system.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in json-schema versions before 0.4.0, where the library improperly handles the __proto__ property during schema validation, particularly in default value and coercion operations. The attack is remotely exploitable with no authentication or user interaction required (CVSS vector AV:N/AC:L/PR:N/UI:N). An attacker can craft a malicious JSON schema that pollutes the Object prototype, affecting all objects created thereafter and potentially leading to confidentiality, integrity, and availability impacts. The fix was released in version 0.4.0 and is available via commits addressing the __proto__ property handling in the validation logic.
Affected products
- json-schema json-schema before 0.4.0
Timeline
- 2021-11-13: disclosed: CVE published
- 2021-11-19: disclosed: GHSA advisory published
- 2021-11-15: patched: Fix available in version 0.4.0