CVE-2020-7766 — Prototype Pollution
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the forc…
Published: 2020-11-10 · CVSS: 7.3 · CVSS 3.1
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7