CVE-2020-15366: Prototype Pollution in Ajv
Summary
CVE-2020-15366: Prototype Pollution in Ajv. Affects ajv versions < 6.12.3. Fixed in 6.12.3. How to fix ↓
Also tracked for
- node-ajv · Debian:11
The same CVE-2020-15366 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ajv (Another JSON Schema Validator) is an open-source library for validating JSON data against JSON schemas. It is widely used in JavaScript and Node.js applications to ensure data consistency and integrity. Ajv provides a comprehensive set of validation features and supports the JSON Schema standard. However, Ajv versions up to and including 6.12.2 are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability, identified as CVE-2020-15366, allows an attacker to execute arbitrary code through prototype pollution. By carefully crafting a malicious JSON schema, an attacker can manipulate the prototype of objects and introduce malicious properties or modify existing ones. This can lead to various security issues, including remote code execution, data tampering, or denial of service attacks. It is important to note that untrusted schemas should be avoided, but the worst-case scenario should be a denial of service, not code execution.
How To Fix
Latest published version: 8.20.0 as of 22 Oct 2026
npm install ajv@8.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.12.3
This is the first release that contains the fix.
npm install ajv@6.12.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Ajv to mitigate the risk of exploitation.
Conclusion
The Ajv library versions up to and including 6.12.2 are vulnerable to prototype pollution, which can lead to code execution and other security issues. It is crucial to update to Ajv version 6.12.3 or later to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ajv →
FAQ
Ajv is an open-source JSON Schema Validator used in JavaScript and Node.js applications for data validation.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of objects, leading to various security issues.
The vulnerability can result in remote code execution, data tampering, or denial of service attacks.
To fix this vulnerability, update Ajv to version 6.12.3 or later.
No, there is no known workaround. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for ajv.
