Description
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Remediation
References
https://www.npmjs.com/package/jpv
https://github.com/manvel-khnkoyan/jpv/issues/6
Related Vulnerabilities
CVE-2020-23256 Vulnerability in npm package electerm
CVE-2023-46652 Vulnerability in maven package org.jenkins-ci.plugins:lambdatest-automation
CVE-2022-25878 Vulnerability in maven package org.webjars.npm:protobufjs
CVE-2020-13445 Vulnerability in maven package com.liferay:com.liferay.portal.template.freemarker
CVE-2020-5497 Vulnerability in maven package org.mitre:openid-connect-server-webapp