Description
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Remediation
References
https://snyk.io/vuln/SNYK-JS-JSON8-1017116
https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e
Related Vulnerabilities
CVE-2023-33202 Vulnerability in maven package org.bouncycastle:bc-fips-debug
CVE-2021-23424 Vulnerability in npm package ansi-html
CVE-2017-16110 Vulnerability in npm package weather.swlyons
CVE-2018-3734 Vulnerability in npm package stattic
CVE-2023-46651 Vulnerability in maven package io.jenkins.plugins:warnings-ng