Log in Start free

Vulnerability · Published Aug 30, 2020 · Assigned by snyk

CVE-2020-7712Command Injection

High 7.2

In plain English

A high-severity security flaw in json. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)3.1%top 12.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.webjars.npm:jsonno fix listedGHSA-3c6g-pvg8-gqw2
npmjson10.0.0GHSA-3c6g-pvg8-gqw2

Affected products (as reported)

VendorProductVersions
n/a json unspecified – before 10.0.0

References