Description

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.

Remediation

References

https://blog.sonatype.com/cve-2020-17479

https://github.com/manvel-khnkoyan/jpv/commit/e3eec1215caa8d5c560f5e88d0943422831927d6

https://github.com/manvel-khnkoyan/jpv/issues/10

https://www.npmjs.com/package/jpv

Related Vulnerabilities

CVE-2022-37616 Vulnerability in npm package @xmldom/xmldom

CVE-2021-3777 Vulnerability in npm package tmpl

CVE-2020-2232 Vulnerability in maven package org.jenkins-ci.plugins:email-ext

CVE-2020-8244 Vulnerability in npm package bl

CVE-2022-29167 Vulnerability in npm package hawk

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch Product