CVE-2020-7770 Prototype Pollution
Prototype pollution in json8 allows attackers to modify object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7770?
CVE-2020-7770 is a medium-severity vulnerability in json8, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Weakness: CWE-1321
Which versions are affected by CVE-2020-7770?
2 open source packages ship an affected version, including json8. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
json8 npm | All versions | 1.0.3 |
json8 npm | All versions | 1.0.3 |
Products include Json8 Project Json8.
How do I fix CVE-2020-7770?
Upgrade json8 to 1.0.3 or later.
Is CVE-2020-7770 being exploited?
There is no known exploitation of CVE-2020-7770 in the wild and no public exploit code.
Sources
Also known as GHSA-7h43-gx24-p529, SNYK-JS-JSON8-1017116.