PT-2021-24459 · Json Ptr · Json-Ptr

Published 2021-05-26 · Updated 2021-05-26

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: json-ptr versions prior to 2.1.0

Description: The issue allows an unscrupulous actor to execute arbitrary code. This occurs when un-sanitized user input is sent to json-ptr's get() method, making the project vulnerable to an injection-style issue.

Recommendations: For json-ptr versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider sanitizing all user input before sending it to the get() method to minimize the risk of exploitation.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-RRQV-VJRW-HRCR

Affected Products

Json-Ptr

References · 9

• https://osv.dev/vulnerability/GHSA-rrqv-vjrw-hrcr · Vendor Advisory
• https://github.com/flitbit/json-ptr/blob/456a1728b45c8663bb1ac20a249c5fb17495ec6b/README.md#security-vulnerability-prior-to-v210 · Note
• https://github.com/flitbit/json-ptr/blob/master/src/util.ts%23L174 · Note
• https://github.com/418sec/json-ptr/pull/3 · Note
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038396 · Note
• https://huntr.dev/bounties/2-npm-json-ptr · Note
• https://npmjs.com/package/json-ptr · Note
• https://snyk.io/vuln/SNYK-JS-JSONPTR-1016939 · Note
• https://npmjs.com/advisories/1706 · Note