Skip to content
Fencer Vulns
high 7.1

CVE-2022-46175 json

Prototype Pollution in JSON5 via Parse Method

published 2022-12-24 3 y ago modified 2026-09-10 1 mo ago also GHSA-9c47-m6qq-7p4h , EUVD-2022-7580

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
9.7%
EPSS 9.7% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Patch / fix

  • npm json5 1.0.2, 2.2.2
  • json5 json5 1.0.2, 2.2.2
  • node-json5 Debian 14, Debian 13, Debian 12 2.2.3+dfsg-1

debian advisories DEBIAN-CVE-2022-46175

  • node-json5 Ubuntu 20.04 LTS 0.5.1-3ubuntu0.1
  • node-json5 Ubuntu Pro 18.04 LTS 0.5.1-1ubuntu0.1~esm1
  • node-json5 Ubuntu Pro 22.04 LTS 2.2.0+dfsg-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-46175

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso

red hat advisories RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-46175 updated cvss 8.8

json5: Prototype Pollution in JSON5 via Parse Method

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, servicemesh-prometheus, openshift-service-mesh/kiali-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat A-MQ Online json5
    affected: no fix planned “Out of support scope”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 aap-azure-ui
    affected: no fix planned “Will not fix”
  • Red Hat build of Apache Camel for Spring Boot 3 json5
    affected: no fix available “Fix deferred”
show 26 more
  • Red Hat Decision Manager 7 json5
    affected: no fix planned “Out of support scope”
  • Red Hat Discovery 1 discovery-server-container
    affected: no fix available
  • Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pcs, pcs-snmp, 389-ds-base, cockpit-389-ds, python3-lib389, 389-ds-base-libs, +2 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 gjs, pcs, pcs-snmp
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 json5
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 json5 Red Hat Integration Camel Quarkus 1 json5
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel8 Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces-theia-rhel8-container
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin
    affected: no fix available
  • Red Hat Process Automation 7 json5
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat MTA 6.0 for RHEL 8 mta/mta-ui-rhel8 6.0.1-10
    fixed: vendor fix RHSA-2023:0934
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.8-5
    fixed: vendor fix RHSA-2023:1428
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 devspaces 3.24-1760676569
    fixed: vendor fix RHSA-2025:19094
  • Red Hat OpenShift Dev Spaces 3 devspaces/dashboard-rhel8 3.15-6
    fixed: vendor fix RHSA-2024:4631
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat RHODF 4.13 for RHEL 9 odf4/mcg-core-rhel9 v4.13.0-41
    fixed: vendor fix RHSA-2023:3742
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/logging-view-plugin-rhel8 v5.6.1-8
    fixed: vendor fix RHSA-2023:0634
  • Red Hat MTA 6.0 for RHEL 8 mta/mta-hub-rhel8 6.0.1-8, mta/mta-pathfinder-rhel8 6.0.1-6, mta/mta-admin-addon-rhel8 6.0.1-8, mta/mta-windup-addon-rhel8 6.0.1-9
    not affected: vulnerable code not present

15 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

9.70% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

Affected packages

ecosystem package affected fixed in
npm json5
>=2.0.0, <2.2.2
<1.0.2
2.2.2
1.0.2

Affected products

  • json5 json5

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.