CVE-2026-15195
- Source
- https://cve.org/CVERecord?id=CVE-2026-15195
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15195.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-15195
- Published
- 2026-07-09T17:15:08Z
- Modified
- 2026-11-04T02:30:27Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution
- Details
-
A weakness has been identified in apidevtools json-schema-ref-parser. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component. The project maintainer confirms: "I reproduced prototype pollution through the public $Refs.set() API in published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5. The same pointer is rejected by 15.3.6 without modifying Object.prototype. This reported path requires an application to pass an attacker-controlled pointer to $Refs.set(); dependency presence alone does not establish exploitability."
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-1321", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15195.json" }- References
-
- https://github.com/APIDevTools/json-schema-ref-parser/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15195.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-15195
- https://vuldb.com/cve/CVE-2026-15195
- https://vuldb.com/submit/851809
- https://vuldb.com/vuln/377123
- https://github.com/APIDevTools/json-schema-ref-parser/issues/421
- https://github.com/APIDevTools/json-schema-ref-parser/issues/421#issuecomment-6547659739
- https://vuldb.com/vuln/377123/cti
- https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84
- https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6
Affected packages
Git / github.com/apidevtools/json-schema-ref-parser
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apidevtools/json-schema-ref-parser
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "7.1.4" }, { "last_affected": "7.1.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "8.0.0" }, { "last_affected": "8.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.0" }, { "last_affected": "9.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.1" }, { "last_affected": "9.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.2" }, { "last_affected": "9.0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.3" }, { "last_affected": "9.0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.5" }, { "last_affected": "9.0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.6" }, { "last_affected": "9.0.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.7" }, { "last_affected": "9.0.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.8" }, { "last_affected": "9.0.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.0.9" }, { "last_affected": "9.0.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.1.0" }, { "last_affected": "9.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "9.1.2" }, { "last_affected": "9.1.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "10.0.0" }, { "last_affected": "10.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "10.0.1" }, { "last_affected": "10.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "10.1.0" }, { "last_affected": "10.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.0.0" }, { "last_affected": "11.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.1.0" }, { "last_affected": "11.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.1.1" }, { "last_affected": "11.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.2.0" }, { "last_affected": "11.2.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.2.1" }, { "last_affected": "11.2.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.2.2" }, { "last_affected": "11.2.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.2.3" }, { "last_affected": "11.2.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.2.4" }, { "last_affected": "11.2.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.3.0" }, { "last_affected": "11.3.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.4.0" }, { "last_affected": "11.4.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.4.1" }, { "last_affected": "11.4.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.4.2" }, { "last_affected": "11.4.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.5.0" }, { "last_affected": "11.5.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.5.1" }, { "last_affected": "11.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.5.2" }, { "last_affected": "11.5.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.5.3" }, { "last_affected": "11.5.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.5.4" }, { "last_affected": "11.5.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.5.5" }, { "last_affected": "11.5.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.6.0" }, { "last_affected": "11.6.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.6.1" }, { "last_affected": "11.6.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.6.2" }, { "last_affected": "11.6.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.6.3" }, { "last_affected": "11.6.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.6.4" }, { "last_affected": "11.6.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.6.5" }, { "last_affected": "11.6.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.7.0" }, { "last_affected": "11.7.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.7.1" }, { "last_affected": "11.7.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.7.2" }, { "last_affected": "11.7.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.7.3" }, { "last_affected": "11.7.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.8.2" }, { "last_affected": "11.8.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.9.0" }, { "last_affected": "11.9.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.9.1" }, { "last_affected": "11.9.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.9.2" }, { "last_affected": "11.9.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "11.9.3" }, { "last_affected": "11.9.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "12.0.0" }, { "last_affected": "12.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "12.0.1" }, { "last_affected": "12.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "12.0.2" }, { "last_affected": "12.0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "13.0.0" }, { "last_affected": "13.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "13.0.1" }, { "last_affected": "13.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "13.0.2" }, { "last_affected": "13.0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "13.0.3" }, { "last_affected": "13.0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "13.0.4" }, { "last_affected": "13.0.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "13.0.5" }, { "last_affected": "13.0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.0.0" }, { "last_affected": "14.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.0.1" }, { "last_affected": "14.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.0.2" }, { "last_affected": "14.0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.0.3" }, { "last_affected": "14.0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.1.0" }, { "last_affected": "14.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.1.1" }, { "last_affected": "14.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.2.0" }, { "last_affected": "14.2.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "14.2.1" }, { "last_affected": "14.2.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.0.0" }, { "last_affected": "15.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.0.1" }, { "last_affected": "15.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.1.0" }, { "last_affected": "15.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.1.1" }, { "last_affected": "15.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.1.2" }, { "last_affected": "15.1.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.1.3" }, { "last_affected": "15.1.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.2.0" }, { "last_affected": "15.2.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.2.1" }, { "last_affected": "15.2.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.2.2" }, { "last_affected": "15.2.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.3.0" }, { "last_affected": "15.3.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.3.1" }, { "last_affected": "15.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.3.2" }, { "last_affected": "15.3.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.3.3" }, { "last_affected": "15.3.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.3.4" }, { "last_affected": "15.3.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "15.3.5" }, { "last_affected": "15.3.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "a786bc6afc3674f650496472ee93d5cf74c4bd84" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v15.3.6", "range": [ { "fixed": "5b1aee585ca0a603f72ec90d51225a535ea8da5f" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
10.*
10.0.0
10.0.1
10.1.0
11.*
11.0.0
11.1.0
11.1.1
11.2.0
11.2.1
11.2.2
11.2.3
11.2.4
11.3.0
11.4.0
11.4.1
11.4.2
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
11.5.5
11.6.0
11.6.1
11.6.2
11.6.3
11.6.4
11.6.5
11.7.0
11.7.1
11.7.2
11.7.3
11.8.2
11.9.0
11.9.1
11.9.2
11.9.3
12.*
12.0.0
12.0.1
12.0.2
13.*
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
14.*
14.0.0
14.0.1
14.0.2
14.0.3
14.1.0
14.1.1
14.2.0
14.2.1
15.*
15.0.0
15.0.1
15.1.0
15.1.1
15.1.2
15.1.3
15.2.0
15.2.1
15.2.2
15.3.0
15.3.1
15.3.2
15.3.3
15.3.4
15.3.5
7.*
7.1.4
8.*
8.0.0
9.*
9.0.0
9.0.1
9.0.2
9.0.3
9.0.5
9.0.6
9.0.7
9.0.8
9.0.9
9.1.0
9.1.2