PT-2020-19782 · Json8 · Json8

Published 2020-11-12 · Updated 2022-12-02 · CVE-2020-7770

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions json8 versions prior to 1.0.3

Description The issue arises from a function that adds properties to a target object without properly checking the key being set, leading to prototype pollution.

Recommendations For versions prior to 1.0.3, update to version 1.0.3 or later to resolve the issue.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2020-7770

GHSA-7H43-GX24-P529

SNYK-JS-JSON8-1017116

Affected Products

Json8

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-JSON8-1017116 · Exploit
• https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7770 · Security Note
• https://osv.dev/vulnerability/GHSA-7h43-gx24-p529 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7770 · Vendor Advisory
• https://npmjs.com/package/json8 · Note
• https://t.me/cibsecurity/16198 · Telegram Post