CVE-2024-38993: jsonic was discovered to contain a prototype pollution via the function empty.
This advisory was withdrawn on Jul 12, 2024. The publisher no longer considers it a valid vulnerability.
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Published Jul 1, 2024 · Updated Jul 12, 2024
Affected packages
jsonic
- Ecosystem
- npm
- Affected
- <= 2.12.1
- Fixed in
- No patched version yet
- Check
npm ls jsonic
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Credited to wzrdtales.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology