VDB
Sign up
HIGH7.2

GHSA-3c6g-pvg8-gqw2

trentm/json vulnerable to command injection

Quick fix

GHSA-3c6g-pvg8-gqw2 — json: upgrade to the fixed version with the command below.

npm install json@10.0.0

Details

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/json
Introduced in: 0Fixed in: 10.0.0
Fixnpm install json@10.0.0
Maven/org.webjars.npm:json
Introduced in: 0

No fixed version published yet for org.webjars.npm:json (maven). Pin to a known-safe version or switch to an alternative.

References