CVE-2021-3918: Prototype Pollution in kriszyp/json-schema
json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Other sources
Json-schema could allow a remote attacker to execute arbitrary code on the system, caused by an improperly controlled modification of object prototype attributes. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2021-3918.
What is the title of this vulnerability?
The title of this vulnerability is 'json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution ) vulnerability'.
What is the severity of CVE-2021-3918?
The severity of CVE-2021-3918 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2021-3918?
The affected software versions are nodejs-json-schema up to exclusive version 0.4.0, node up to exclusive version 16.11.0, and npm up to exclusive version 8.1.0.
How can an attacker exploit CVE-2021-3918?
An attacker can exploit CVE-2021-3918 by providing a specially crafted JSON file for validation, which can lead to arbitrary code execution.