Description

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.

Remediation

References

https://snyk.io/vuln/SNYK-JS-SCHEMAINSPECTOR-536970

https://github.com/Atinux/schema-inspector/commit/345a7b2eed11bb6128421150d65f4f83fdbb737d

Related Vulnerabilities

CVE-2019-19771 Vulnerability in npm package bcion

CVE-2015-2080 Vulnerability in maven package org.eclipse.jetty:jetty-http

CVE-2020-28500 Vulnerability in maven package org.webjars.bowergithub.lodash:lodash

CVE-2022-31108 Vulnerability in npm package mermaid

CVE-2018-3744 Vulnerability in npm package html-pages

Severity

Critical

Classification

CWE-668 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Patch