Skip to content
OpenAdvisories
High USN-6758-1 1 CVE

node-json5 vulnerability

Published Apr 30, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the JSON5 parse method incorrectly handled the parsing
of keys named \_\_proto\_\_. An attacker could possibly use this issue to pollute
the prototype of the returned object, setting arbitrary or unexpected keys, and
cause a denial of service, allow unintended access to network services or have
other unspecified impact, depending on the application's use of the module.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS node-json5 0.5.1-3ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS node-json5 0.5.1-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS node-json5 2.2.0+dfsg-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.1
    CVE-2022-46175 Public exploit

    Prototype Pollution in JSON5 via Parse Method

    JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `…

    json5 json5 js-jquery node-json5 Debian Ubuntu Azure Linux Wolfi npm

References

  • report
    https://ubuntu.com/security/CVE-2022-46175