Description
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | json-ptr | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | json-ptr | < 2.1.0 | 2.1.0 | GHSA-x5r6-x823-9848 |