EUVD-2026-42651
GHSA-hghm-9vcp-cxvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable prototype pollution requiring low privileges; scope unchanged as direct impact is limited to vulnerable system with L/L/L impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component.
AnalysisAI
Prototype pollution in apidevtools json-schema-ref-parser up to v15.3.5 allows low-privileged remote attackers to modify Object prototype attributes via crafted input to the Refs.set/Pointer.set functions in lib/pointer.ts. The vulnerability is tagged RCE and Code Injection, reflecting the theoretical worst-case of prototype pollution in Node.js environments where polluted properties propagate to dangerous sinks; however, the CVSS 4.0 score of 2.1 with limited (L/L/L) impact ratings suggests the direct, exploitable impact is constrained. A proof-of-concept exists (CVSS 4.0 E:P) but no confirmed active exploitation has been recorded in CISA KEV.
Technical ContextAI
json-schema-ref-parser is a Node.js/JavaScript library by APIDevTools that resolves JSON $ref pointers within JSON Schema and OpenAPI documents, dereferencing nested or remote references into a single schema object. The vulnerability resides in lib/pointer.ts, specifically the Refs.set and Pointer.set methods responsible for writing resolved reference values back into the schema object graph. CWE-94 (Improper Control of Generation of Code) encompasses prototype pollution in JavaScript: by crafting a $ref pointer path that targets reserved prototype keys such as __proto__, constructor, or prototype, an attacker can inject arbitrary properties onto the global Object prototype. In Node.js, polluted prototype properties can propagate silently to all objects in the process, potentially reaching dangerous sinks in template engines, child_process calls, or property-access patterns - explaining the RCE tag despite the low direct CVSS impact. The affected version range is <=15.3.5; the fix is in commit a786bc6afc3674f650496472ee93d5cf74c4bd84, released as v15.3.6.
RemediationAI
Upgrade json-schema-ref-parser to version 15.3.6 or later, which incorporates the fix at commit a786bc6afc3674f650496472ee93d5cf74c4bd84. The patched release is available at https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6. Run 'npm install @apidevtools/json-schema-ref-parser@15.3.6' or update the relevant lockfile entry. If immediate upgrade is not possible, restrict the library to processing only trusted, internally-authored schema documents - do not pass user-supplied or third-party-fetched JSON Schema content through the parser without sanitizing $ref pointer paths for prototype-reserved keys (__proto__, constructor, prototype) before resolution. This input sanitization approach has the trade-off of requiring maintenance as new prototype-targeting gadgets are discovered.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today