Executive brief
A security vulnerability exists in the sagold json-schema-library, a tool used for validating and generating data based on JSON schemas. An attacker can provide a specially crafted schema that modifies the core behavior of the application's programming environment. This can lead to data corruption, application instability, or unauthorized access to information.
Technical details
A prototype pollution vulnerability exists in sagold json-schema-library versions 11.5.0 and 11.5.1 within the parsePropertyDependencies function in src/keywords/propertyDependencies.ts. The vulnerability occurs when the experimental propertyDependenciesKeyword is used; specifically, the library fails to sanitize keys such as __proto__ when compiling a schema. A remote attacker with the ability to provide or influence a schema can inject properties into the global Object.prototype. This can result in improper control of code generation (CWE-94) or modification of object attributes (CWE-1321). The issue is resolved in version 11.6.0.
Affected products
- sagold json-schema-library 11.5.0, 11.5.1
Timeline
- 2026-06-12: disclosed: Issue reported on GitHub repository
- 2026-06-14: patched: Version 11.6.0 released with fix
- 2026-07-17: advisory: CVE-2026-16008 published
References
- https://github.com/sagold/json-schema-library/
- https://github.com/sagold/json-schema-library/commit/432287ee6f68a02ce6f015354618486ec427a32d
- https://github.com/sagold/json-schema-library/issues/111
- https://github.com/sagold/json-schema-library/releases/tag/v11.6.0
- https://vuldb.com/cve/CVE-2026-16008
- https://vuldb.com/submit/856721
- https://vuldb.com/vuln/379752