Executive brief
fastest-json-copy is a JavaScript library used to efficiently copy JSON objects. An attacker can exploit a prototype pollution vulnerability to add or modify properties on an object by crafting malicious JSON input with special keys like __proto__. This could allow an attacker to inject properties that affect the behavior of the application or introduce unexpected code execution paths.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in fastest-json-copy version 1.0.1. The library fails to properly validate JSON keys during object copying, allowing an attacker to manipulate the __proto__ property and pollute the prototype chain. The attack requires only a network connection with no authentication or user interaction needed. Successful exploitation allows an attacker to add or edit properties on objects, potentially affecting application logic or security guarantees. A patch is available; users should upgrade to a version later than 1.0.1.
Affected products
- fastest-json-copy fastest-json-copy 1.0.1 and earlier
Timeline
- 2022-11-04: disclosed
- 2022-11-03: advisory: NVD published