Vulnerability · Published Nov 13, 2021 · Assigned by @huntrdev
CVE-2021-3918Prototype Pollution in kriszyp/json-schema
Critical 9.8
In plain English
A critical-severity prototype pollution in kriszyp/json-schema from kriszyp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)9.8Critical
Exploit odds (30 days)3.8%top 9.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:16.13.1-3.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs | 1:16.13.1-3.module_el8.5.0+246+05401605 | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-devel | 1:14.18.2-2.module_el8.5.0+254+b4526b16 | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-devel | 1:16.13.1-3.module_el8.5.0+246+05401605 | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-devel | 1:16.13.1-3.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-devel | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-docs | 1:16.13.1-3.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-docs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-docs | 1:16.13.1-3.module_el8.5.0+246+05401605 | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-docs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+254+b4526b16 | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+246+05401605 | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.15-1.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 | ALSA-2022:0350 |
| AlmaLinux:8 | nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-packaging | 25-1.module_el8.5.0+246+05401605 | ALSA-2021:5171 |
| AlmaLinux:8 | nodejs-packaging | 23-3.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af | ALSA-2021:5171 |
| AlmaLinux:8 | npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd | ALSA-2022:0350 |
| AlmaLinux:8 | npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16 | ALSA-2022:0350 |
| AlmaLinux:8 | npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605 | ALSA-2021:5171 |
| Debian:12 | node-json-schema | 0.4.0+~7.0.9-1 | DEBIAN-CVE-2021-3918 |
| Debian:13 | node-json-schema | 0.4.0+~7.0.9-1 | DEBIAN-CVE-2021-3918 |
| Debian:14 | node-json-schema | 0.4.0+~7.0.9-1 | DEBIAN-CVE-2021-3918 |
| Rocky Linux:8 | nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 | RLSA-2021:5171 |
| Rocky Linux:8 | nodejs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c | RLSA-2022:0350 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.15-1.module+el8.5.0+721+4c107270 | RLSA-2022:0350 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.15-1.module+el8.5.0+721+4c107270 | RLSA-2021:5171 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.3.0+100+234774f7 | RLSA-2022:0350 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.5.0+733+de4fee6c | RLSA-2022:0350 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.5.0+702+221f14e6 | RLSA-2021:5171 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.6.0+1046+80feca58 | RLSA-2021:5171 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.7.0+1071+4bdda2a8 | RLSA-2022:0350 |
| npm | json-schema | 0.4.0 | GHSA-896r-f27r-55mw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kriszyp | kriszyp/json-schema | unspecified – through 0.3.0 |
Weakness: CWE-1321 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://huntr.dev/bounties/bb6ccd63-f505-4e3a-b55f-cd2662c261a9
- https://github.com/kriszyp/json-schema/commit/22f146111f541d9737e832823699ad3528ca7741
- [debian-lts-announce] 20221206 [SECURITY] [DLA 3228-1] node-json-schema security update mailing-list
- https://security.netapp.com/advisory/ntap-20250117-0004/