jsonic was discovered to contain a prototype pollution via the function empty.

Description

rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.12.1

References

GHSA-4wm9-3qmv-gvxj
CVE-2024-38993
CWE-1321
CWE-94
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for jsonic was discovered to contain a prototype pollution via the function empty. and gives you actionable findings to investigate.

Start a free scan

Related Issues

akbr patch-into was discovered to contain a prototype pollution via the function patchInto - CVE-2024-38991
adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults - CVE-2024-38997
Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise - CVE-2024-38996
Prototype pollution in ag-grid-community via the _.mergeDeep function - CVE-2024-38996

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated July 12, 2024