Packages / ajv / Security

ModerateVulnerabilityGHSA-v88g-cgmw-v5xwCVE-2020-15366Published 10 Feb 2022

Prototype Pollution in Ajv

Affected releases · ajv

  • 6.x6.0.0 – 6.12.2Fixed in 6.12.3
  • 5.x and older0.0.4 – 5.5.2No fix, no longer updated

On 6.x, the newest line:

npm install ajv@6.12.3
8.x

  1. Not affected

    8.0.0 – 8.20.0

    33 releases, latest

6.x

  1. Affected

    6.0.0 – 6.12.2

    30 releases

  2. Fixed

    6.12.3 – 6.15.0

    6 releases

5.x

  1. Affected

    5.0.0 – 5.5.2

    20 releases

4.x

  1. Affected

    4.0.0 – 4.11.8

    53 releases

3.x

  1. Affected

    3.0.0 – 3.8.10

    35 releases

2.x

  1. Affected

    2.0.0 – 2.5.0

    15 releases

1.x

  1. Affected

    1.0.0 – 1.4.10

    20 releases

0.x

  1. Affected

    0.0.4 – 0.7.2

    93 releases

317 stable releases of ajv, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for ajv. It is read in your browser and sent nowhere.

What happens

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)