CVE-2019-10781 Validation Bypass in schema-inspector
Attackers can bypass sanitization and validation in schema-inspector using crafted objects, potentially allowing malicious data to pass through security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10781?
CVE-2019-10781 is a critical vulnerability in Snyk schema-inspector, published on 22 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
Weakness: CWE-668
Which versions are affected by CVE-2019-10781?
2 open source packages ship an affected version, including schema-inspector. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
schema-inspector npm | All versions | 1.6.9 |
schema-inspector npm | All versions | 1.6.9 |
Products include Schema-Inspector Project Schema-Inspector.
How do I fix CVE-2019-10781?
Upgrade schema-inspector to 1.6.9 or later.
Is CVE-2019-10781 being exploited?
There is no known exploitation of CVE-2019-10781 in the wild and no public exploit code.
Sources
Also known as GHSA-r24h-634p-m72x, SNYK-JS-SCHEMAINSPECTOR-536970.