Read the docs
TI-2020-06232 Aliases CVE-2020-7712GHSA-3c6g-pvg8-gqw2

Command injection in json

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03112 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed json: 10.0.0json (npm): 10.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—jsonbefore 10.0.010.0.0Patch availableCNA
—json (npm)before 10.0.010.0.0Patch availableGHSA-3c6g-pvg8-gqw2
—org.webjars.npm:json (Maven)up to 9.0.6—No fix listedGHSA-3c6g-pvg8-gqw2
  • json Vendor— Affected before 10.0.0 Fixed in 10.0.0 Patch available CNA
  • json (npm) Vendor— Affected before 10.0.0 Fixed in 10.0.0 Patch available GHSA-3c6g-pvg8-gqw2
  • org.webjars.npm:json (Maven) Vendor— Affected up to 9.0.6 Fixed in — No fix listed GHSA-3c6g-pvg8-gqw2

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:joyent:json:*:*:*:*:*:node.js:*:*before 10.0.0VulnerableJoyent
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*8.0.8.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*8.0.8.3.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.6.3:*:*:*:*:*:*:*8.0.9.6.3VulnerableOracle
cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*before 21.1.1.1.0VulnerableOracle
  • cpe:2.3:a:joyent:json:*:*:*:*:*:node.js:*:* Versions before 10.0.0 Vulnerable ·Joyent
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.6.3:*:*:*:*:*:*:* Versions 8.0.9.6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 21.1.1.1.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA json Fixed in 10.0.0
  • Fix · GHSA-3c6g-pvg8-gqw2 json (npm) Fixed in 10.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7712
  2. 2026-10-03 Alias added: GHSA-3c6g-pvg8-gqw2
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 4

Advisory 1

Other 30

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences