This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-15366 →

DEBIAN-CVE-2020-15366

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that al...

Original description

The description as published by the source.

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-ajv

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.4-1"}]}]

Debian:13 node-ajv

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.4-1"}]}]

Debian:14 node-ajv

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.4-1"}]}]

References

advisory security-tracker.debian.org