Prototype Pollution Vulnerability in node-json5 Package
Summary
DEBIAN-CVE-2022-46175: JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. Affects node-json5 versions < 2.1.3-2+deb11u1. Fixed in 2.1.3-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-json5 is a JavaScript library that extends the JSON format to make it easier to write and maintain configuration files. It allows for comments, unquoted keys, and other features that standard JSON does not support. However, certain versions of node-json5 are vulnerable to a prototype pollution issue, which can lead to significant security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the parse method of the JSON5 library, which, in versions prior to 1.0.2 and 2.2.2, does not restrict the parsing of keys named __proto__. This oversight allows attackers to manipulate the prototype of the object returned by JSON5.parse, potentially leading to security issues such as denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. The impact of this vulnerability depends on how the returned object is utilized in the application.
How To Fix
Minimum fixed version
2.1.3-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-json5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can replace calls to JSON5.parse with JSON.parse, which does not allow the parsing of __proto__ keys. This change can help mitigate the vulnerability until the package is updated.
Conclusion
The node-json5 package has a critical vulnerability related to prototype pollution that can lead to severe security implications. It is essential to update to the patched versions to safeguard your applications. Additionally, using Vulert can help you monitor for such vulnerabilities in real-time.
See every vulnerability recorded for node-json5 →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of an object, potentially leading to unexpected behavior and security risks in applications.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The risks include denial of service, cross-site scripting, elevation of privilege, and potentially remote code execution, depending on how the affected object is used in the application.
Yes, you can temporarily mitigate the issue by replacing JSON5.parse with JSON.parse, which does not allow the parsing of __proto__ keys.
More information can be found in the official Debian CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-json5.
