Description (CNA)
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / json8 | affected unspecified before 1.0.3 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-JSON8-1017116
- https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e
ADP enrichment
No English description supplied.