CVE-2022-4742: Prototype Pollution in json-pointer
Summary
CVE-2022-4742: json-pointer vulnerable to Prototype Pollution. Affects json-pointer versions < 0.6.2. Fixed in 0.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
json-pointer is an npm package that provides a set of functions for working with JSON Pointers. JSON Pointers are used to reference specific values within a JSON document. The package is widely used in JavaScript applications to manipulate and access JSON data. Unfortunately, json-pointer is vulnerable to a critical security issue known as Prototype Pollution.
Vulnerability Detail
The vulnerability in json-pointer arises from improper handling of user-controlled input in the 'set' function of the index.js file. This allows an attacker to manipulate the object prototype attributes, leading to Prototype Pollution. Prototype Pollution is a type of vulnerability where an attacker can modify the behavior of existing objects or introduce new properties into the prototype chain. This can have severe consequences, such as remote code execution or unauthorized access to sensitive data. The vulnerability has been assigned the identifier CVE-2022-4742 and has a CVSS score of 9.8 (Critical).
How To Fix
Latest published version: 0.6.2 as of 23 Oct 2026
npm install json-pointer@0.6.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the json-pointer package to the fixed version as soon as possible.
Conclusion
The json-pointer package is vulnerable to Prototype Pollution, which can have severe consequences for the security of your application. It is crucial to update the package to version 0.6.2 or later to mitigate this vulnerability. If you need further assistance or support in remediating this vulnerability, you can reach out to DevNack.com.
See every vulnerability recorded for json-pointer →
FAQ
json-pointer is an npm package used for working with JSON Pointers, which are used to reference specific values within a JSON document.
Prototype Pollution is a vulnerability that allows an attacker to modify the behavior of existing objects or introduce new properties into the prototype chain.
The consequences of this vulnerability can range from remote code execution to unauthorized access to sensitive data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-6xrf-q977-5vgc/GHSA-6xrf-q977-5vgc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for json-pointer.
