json-pointer index.js set prototype pollution

published 2022-12-26 3 y ago modified 2026-06-17 4 mo ago also GHSA-6xrf-q977-5vgc , EUVD-2022-7545

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 0; none known

A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.

Patch / fix

fixed in 2 links 2

npm json-pointer 0.6.2
json-pointer_project json-pointer 2022-2-17

github.com/manuelstofer/json-pointer@859c998 commit
github.com/manuelstofer/json-pointer#36 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-4742 updated 2026-11-07 cvss 9.8

json-pointer: prototype pollution in json-pointer

Red Hat Integration Camel K 1 json-pointer Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
affected: no fix planned “Will not fix”
Red Hat RHINT Service Registry 2.4.3 GA
fixed: vendor fix RHSA-2023:3815

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	json-pointer	<0.6.2	0.6.2

Affected products

n/a json-pointer

Classification

Weakness

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

github.com /manuelstofer/json-pointer/pull/36
issue-tracking, web, patch, third-party-advisory
github.com /manuelstofer/json-pointer/commit/859c9984b6c407fc2d5a0a7e47c7274daa681941
patch, web, third-party-advisory
vuldb.com /?id.216794
vdb-entry, technical-description, web, third-party-advisory
vuldb.com /?ctiid.216794
signature, permissions-required, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-4742
advisory
github.com /manuelstofer/json-pointer
package

Sources

CVE List CVE-2022-4742
GitHub Advisory GHSA-6xrf-q977-5vgc
NVD CVE-2022-4742

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary