Prototype pollution in json8
Priority MEDIUM 46CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Why it matters now
EPSS 0.01893 79th percentileScored 2026-11-07
Fix Fixed json8: 1.0.3json8 (npm): 1.0.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | json8 | before 1.0.3 | 1.0.3 | Patch available | CNA |
| — | json8 (npm) | before 1.0.3 | 1.0.3 | Patch available | GHSA-7h43-gx24-p529 |
- json8 Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available CNA
- json8 (npm) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-7h43-gx24-p529
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:json8_project:json8:*:*:*:*:*:*:*:* | before 1.0.3 | Vulnerable | Json8 Project |
- cpe:2.3:a:json8_project:json8:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·Json8 Project
Remediation
- Fix · CNA json8 Fixed in 1.0.3
- Fix · GHSA-7h43-gx24-p529 json8 (npm) Fixed in 1.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7770
- 2026-10-03 Alias added: GHSA-7h43-gx24-p529
References
Sources
- CVE-2020-7770 · CVE Program
- CVE-2020-7770 · NVD
- FIRST EPSS
- GHSA-7h43-gx24-p529 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences