CVE-2022-46175: Prototype Pollution in JSON5 via Parse Method
Summary
CVE-2022-46175: Prototype Pollution in JSON5 via Parse Method. Affects json5 across 2 version ranges.
< 1.0.2
>= 2.0.0, < 2.2.2
Fixed in 1.0.2 or 2.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-json5 · Debian:11
The same CVE-2022-46175 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
JSON5 is an open-source library that provides a superset of JSON syntax, allowing for additional features such as comments and trailing commas. It is commonly used in JavaScript applications for parsing and manipulating JSON-like data. However, versions before and including 2.2.1 of JSON5 are vulnerable to prototype pollution through the parse method.
Vulnerability Detail
The parse method of JSON5 does not properly restrict the parsing of keys named __proto__, which can be exploited by crafting specially designed strings. This vulnerability allows an attacker to pollute the prototype of the object returned by JSON5.parse, potentially leading to various security issues. While the pollution affects only the prototype of a single object, it can still have significant consequences if the object is later used in trusted operations. The impact of this vulnerability depends on how applications utilize the returned object and filter unwanted keys, but it could result in denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.
How To Fix
Latest published version: 2.2.3 as of 22 Oct 2026
npm install json5@2.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.0.21.0.2npm install json5@1.0.2 -
>= 2.0.0, < 2.2.22.2.2npm install json5@2.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the JSON5 library is not immediately feasible, developers can implement a workaround by manually filtering out unwanted keys after parsing the JSON data. This can be done by using a function to check for and remove any unwanted keys from the parsed object. Here is an example of how this can be implemented:
const JSON5 = require('json5');
const secCheckKeysSet = (obj, searchKeys) => {
let searchKeyFound = false;
Object.keys(obj).forEach((key) => {
if (searchKeys.indexOf(key) > -1) {
searchKeyFound = true;
delete obj[key];
}
});
return searchKeyFound;
};
const data = '{"foo": "bar", "__proto__": {"isAdmin": true}}';
const parsedData = JSON5.parse(data);
secCheckKeysSet(parsedData, ['isAdmin', 'isMod']);
console.log(parsedData);
This workaround manually removes any unwanted keys, such as isAdmin and isMod, from the parsed object.
Conclusion
The vulnerability in JSON5's parse method allows for prototype pollution, which can have significant security implications for applications. It is crucial to update the JSON5 library to the latest patched version to mitigate this vulnerability. Developers can also implement a workaround by manually filtering out unwanted keys after parsing the JSON data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json5 →
FAQ
JSON5 is an extension of the JSON data interchange format that adds support for additional features such as comments, trailing commas, and more flexible syntax.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, potentially leading to unexpected behavior or security issues.
The impact of this vulnerability depends on how applications utilize the returned object from JSON5.parse and how they filter unwanted keys. It could result in denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.
Yes, the vulnerability has been patched in JSON5 version 2.2.2 and later. A patch has also been backported for JSON5 version 1 in versions 1.0.2 and later.
To fix the vulnerability, developers should update their JSON5 dependency to the latest patched version (2.2.2 or later for JSON5 version 2, and 1.0.2 or later for JSON5 version 1).
References
Related vulnerabilities
Recent vulnerabilities recorded for json5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
