CVE-2022-46175 is a prototype pollution vulnerability in the JSON5 library (versions 1.0.1 and 2.2.1 and earlier) that allows specially crafted JSON5 strings to pollute the prototype of objects returned by JSON5.parse. This high-severity vulnerability (CVSS 8.8) can lead to denial of service, cross-site scripting, elevation of privilege, or remote code execution, depending on how applications use the affected objects. While the vulnerability is not actively exploited and no public exploit code exists, its EPSS score indicates a higher than average potential for exploitation. The fix involves upgrading to JSON5 versions 1.0.2, 2.2.2, or later, or using JSON.parse instead.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.2CPE matchmatch criteria | cpe:2.3:a:json5:json5:*:*:*:*:*:node.js:*:* | ||
>= 2.0.0, < 2.2.2CPE matchmatch criteria | cpe:2.3:a:json5:json5:*:*:*:*:*:node.js:*:* | ||
37CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-46175
Sep 10, 2024Splunk Enterprise Security (ES) Third-Party Package Updates - January 2024
Jan 9, 2024August 2023 Third Party Package Updates in Splunk Enterprise
Aug 30, 2023Prototype Pollution in JSON5 via Parse Method
Dec 29, 2022json5: Prototype Pollution in JSON5 via Parse Method
Dec 24, 2022JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__` allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype which is the commonly understood definition of Prototype Pollution. However polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys but could include denial of service cross-site scripting elevation
Dec 13, 2022