-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient validation in the applyOperation function across all implementations (TypeScript, CommonJS, and ESM). The commit diff shows the fix added checks for both __proto__ and constructor/prototype path segments. Prior to the patch, these functions allowed modification of prototype attributes via nested keys, as demonstrated in the PoC using paths like /constructor/prototype/polluted. The functions' role in processing JSON Patch operations made them the entry point for uncontrolled prototype modifications.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fast-json-patch | npm | < 3.1.1 | 3.1.1 |