Description
A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`, `parse()`, `resolve()`, `dereference() functions.
Scores
CVSS v3
8.1
EPSS
0.0279
EPSS Percentile
86.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-1321
Status
published
Products (1)
apidevtools/json-schema-ref-parser
11.0.0 - 11.2.0npm
Published
May 20, 2024
Tracked Since
Feb 18, 2026