Skip to content
OpenAdvisories
Medium · 5.3 CVE-2019-19507 EUVD-2019-0801GHSA-rh46-3fgc-mvrf

Validation bypass is possible in Json Pattern Validator

Published Dec 2, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Description

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Affected packages

EcosystemPackageAffectedFixedRecord
npm jpv < 2.1.1 2.1.1 GHSA-rh46-3fgc-mvrf

References