CVE-2022-46175: Prototype Pollution in JSON5 via Parse Method
Summary
Your scan reports json5 2.1.3. Fixed in 2.2.2.
CVE-2022-46175: Prototype Pollution in JSON5 via Parse Method. Affects json5 across 2 version ranges.
< 1.0.2
>= 2.0.0, < 2.2.2
Fixed in 2.2.2. How to fix ↓
Also tracked for
- node-json5 · Debian:11
The same CVE-2022-46175 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Background
JSON5 is an open-source library that provides a superset of JSON syntax, allowing for additional features such as comments and trailing commas. It is commonly used in JavaScript applications for parsing and manipulating JSON-like data. However, versions before and including 2.2.1 of JSON5 are vulnerable to prototype pollution through the parse method.
Vulnerability Detail
The parse method of JSON5 does not properly restrict the parsing of keys named __proto__, which can be exploited by crafting specially designed strings. This vulnerability allows an attacker to pollute the prototype of the object returned by JSON5.parse, potentially leading to various security issues. While the pollution affects only the prototype of a single object, it can still have significant consequences if the object is later used in trusted operations. The impact of this vulnerability depends on how applications utilize the returned object and filter unwanted keys, but it could result in denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.
How To Fix
Latest published version: 2.2.3 as of 22 Oct 2026
npm install json5@2.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.2
This is the first release that contains the fix.
npm install json5@2.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the JSON5 library is not immediately feasible, developers can implement a workaround by manually filtering out unwanted keys after parsing the JSON data. This can be done by using a function to check for and remove any unwanted keys from the parsed object. Here is an example of how this can be implemented:
const JSON5 = require('json5');
const secCheckKeysSet = (obj, searchKeys) => {
let searchKeyFound = false;
Object.keys(obj).forEach((key) => {
if (searchKeys.indexOf(key) > -1) {
searchKeyFound = true;
delete obj[key];
}
});
return searchKeyFound;
};
const data = '{"foo": "bar", "__proto__": {"isAdmin": true}}';
const parsedData = JSON5.parse(data);
secCheckKeysSet(parsedData, ['isAdmin', 'isMod']);
console.log(parsedData);
This workaround manually removes any unwanted keys, such as isAdmin and isMod, from the parsed object.
Conclusion
The vulnerability in JSON5's parse method allows for prototype pollution, which can have significant security implications for applications. It is crucial to update the JSON5 library to the latest patched version to mitigate this vulnerability. Developers can also implement a workaround by manually filtering out unwanted keys after parsing the JSON data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json5 →
FAQ
JSON5 is an extension of the JSON data interchange format that adds support for additional features such as comments, trailing commas, and more flexible syntax.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, potentially leading to unexpected behavior or security issues.
The impact of this vulnerability depends on how applications utilize the returned object from JSON5.parse and how they filter unwanted keys. It could result in denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.
Yes, the vulnerability has been patched in JSON5 version 2.2.2 and later. A patch has also been backported for JSON5 version 1 in versions 1.0.2 and later.
To fix the vulnerability, developers should update their JSON5 dependency to the latest patched version (2.2.2 or later for JSON5 version 2, and 1.0.2 or later for JSON5 version 1).
References
Related vulnerabilities
Recent vulnerabilities recorded for json5.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.