Description
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Remediation
References
https://snyk.io/vuln/SNYK-JS-JSON8-1017116
https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e
Related Vulnerabilities
CVE-2023-37955 Vulnerability in maven package org.jenkins-ci.plugins:test-results-aggregator
CVE-2020-36381 Vulnerability in npm package aaptjs
CVE-2023-46493 Vulnerability in npm package @evershop/evershop
CVE-2020-28448 Vulnerability in npm package multi-ini
CVE-2022-32287 Vulnerability in maven package org.apache.uima:uimaj-core