Critical Vulnerability in node-json5: Prototype Pollution Risk
Summary
USN-6758-1: node-json5 vulnerability. Affects node-json5 versions < 0.5.1-1ubuntu0.1~esm1. Fixed in 0.5.1-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-json5 is a popular JavaScript library that extends JSON with additional features, allowing for more flexible data representation. It is widely used in various applications for parsing and stringifying JSON-like data. However, a recently discovered vulnerability in this package poses a significant risk, as it allows attackers to manipulate object prototypes, potentially leading to severe security issues.
Vulnerability Detail
The vulnerability arises from the JSON5 parse method's improper handling of keys named 'proto'. This flaw can be exploited by attackers to pollute the prototype of the returned object, enabling them to set arbitrary or unexpected keys. The consequences of this vulnerability can range from denial of service to unauthorized access to network services, depending on how the affected application utilizes the node-json5 module.
How To Fix
Minimum fixed version
0.5.1-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-json5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize keys before parsing JSON5 data. This can help mitigate the risk of prototype pollution until the package is updated.
Conclusion
The node-json5 vulnerability presents a serious risk due to its potential for prototype pollution. It is crucial for users of this package to update to the latest patched versions to safeguard their applications. Implementing input validation can serve as a temporary measure until an update is applied.
See every vulnerability recorded for node-json5 →
FAQ
The vulnerability allows for prototype pollution through improper handling of keys, which can lead to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts can include denial of service, unauthorized access to network services, and other unspecified consequences depending on the application's use of the module.
Yes, implementing input validation to sanitize keys can help mitigate the risk until the package is updated.
Detailed information can be found in the Ubuntu Security Notices at https://github.com/canonical/ubuntu-security-notices.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-json5.
