Vulnerability in node-json5 - Prototype Injection
Summary
DLA-3665-1: node-json5 - security update. Affects node-json5 versions < 0.5.1-1+deb10u1. Fixed in 0.5.1-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-json5 is a pure JavaScript implementation of the JSON5 standard. It provides additional functionality and flexibility compared to the standard JSON format. However, a vulnerability has been discovered in node-json5 that allows for prototype injection during parsing.
Vulnerability Detail
The vulnerability in node-json5 arises from a lack of proper input validation during parsing. An attacker can exploit this by injecting malicious prototype properties into the parsed JSON5 object. This can lead to various security issues, including remote code execution, information disclosure, and denial of service attacks.
How To Fix
Minimum fixed version
0.5.1-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-json5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the node-json5 package to the fixed version.
Conclusion
The vulnerability in node-json5 allows for prototype injection during parsing, which can lead to severe security issues. It is crucial to upgrade to the fixed version of the package (0.5.1-1+deb10u1 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-json5 →
FAQ
node-json5 is a JavaScript library that provides a pure JavaScript implementation of the JSON5 standard. It allows for more flexible and human-readable JSON-like data structures.
Prototype injection is a technique where an attacker can modify the prototype of an object to add or modify properties and methods. This can lead to unexpected behavior and security vulnerabilities.
The consequences of this vulnerability can vary depending on the specific usage of node-json5 in an application. However, possible outcomes include remote code execution, information disclosure, and denial of service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
You can find more information about this vulnerability, including its security tracker page and Debian LTS security advisories, at https://security-tracker.debian.org/tracker/node-json5
Related vulnerabilities
Recent vulnerabilities recorded for node-json5.
