Command injection in json
Summary
CVE-2020-7712: Command injection in json. Affects json versions < 10.0.0. Fixed in 10.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
How To Fix
Latest published version: 11.0.0 as of 23 Oct 2026
npm install json@11.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.0
This is the first release that contains the fix.
npm install json@10.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for json.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
