npm/jsonata CVE-2024-27307: critical 9.8, EPSS 1.42%
JSONata expression can pollute the "Object" prototype
Action: Upgrade jsonata to 1.8.7 or later.
npm i jsonata@1.8.7npm i jsonata@2.0.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.0 | 1.8.7 | - |
| 2.0.0 | 2.0.4 | - |
Fixed versions
| 1.8.7 | 2.0.4 |
Sources
- osv: GHSA-fqg8-vfv7-8fj8
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8
- https://nvd.nist.gov/vuln/detail/CVE-2024-27307
- https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1
- https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c
- https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2
- https://github.com/jsonata-js/jsonata
- https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4
CVE-2024-27307 · published · modified · JSON