GHSA-4wm9-3qmv-gvxj

Source

https://github.com/advisories/GHSA-4wm9-3qmv-gvxj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-4wm9-3qmv-gvxj/GHSA-4wm9-3qmv-gvxj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4wm9-3qmv-gvxj

Aliases

CVE-2024-38993

Withdrawn

2024-07-12T19:08:25Z

Published

2024-07-01T15:32:13Z

Modified

2026-09-10T03:50:16Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

jsonic was discovered to contain a prototype pollution via the function empty.

Details

rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Database specific

{
    "cwe_ids":  [
        "CWE-1321",
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-07-01T21:52:44Z",
    "nvd_published_at":  "2024-07-01T13:15:04Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / jsonic

Package

Name: jsonic; View open source insights on deps.dev
Purl: pkg:npm/jsonic

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.12.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-4wm9-3qmv-gvxj/GHSA-4wm9-3qmv-gvxj.json"