CVE-2020-7766

Prototype Pollution

7.3 HighFix available

This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

1.90%Up 1.1 points since Apr 14, 2021

What each source reports

CVE List Score used 7.3

Prototype Pollution

Record: CVE-2020-7766
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Updated: 2026-11-02

EUVDEUVD-2021-1228 7.3

Record: EUVD-2021-1228
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x5r6-x823-9848 7.3

Arbitrary Code Execution in json-ptr

npm json-ptr before 2.1.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

Record: GHSA-x5r6-x823-9848
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-74, CWE-400, CWE-1321
Updated: 2026-11-02

NVD 7.3

Record: CVE-2020-7766
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-1321
Updated: 2026-11-02

OSVGHSA-x5r6-x823-9848 7.3

Arbitrary Code Execution in json-ptr

Record: GHSA-x5r6-x823-9848
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-1321, CWE-400, CWE-74
Updated: 2026-11-02

Affected products

json-ptr project json-ptr

Affected packages

Affected packages
Package	Affected	Fixed
`json-ptr` npm	before 2.1.0	2.1.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-7766 is a high vulnerability (CVSS 7.3) in Json-ptr Project Json-ptr, published November 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in json-ptr 2.1.0.