{"id":"GHSA-rrqv-vjrw-hrcr","aliases":[],"status":"published","title":"Arbitrary Code Execution in json-ptr","description":"There is a security vulnerability in `json-ptr` versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2021-05-26T19:59:19Z","modified":"2023-01-09T05:05:26Z","fixes":[{"ecosystem":"npm","package":"json-ptr","fixed_in":["2.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"json-ptr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"json-ptr","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]}],"references":[{"url":"https://github.com/418sec/json-ptr/pull/3","tags":["web"]},{"url":"https://github.com/flitbit/json-ptr/blob/456a1728b45c8663bb1ac20a249c5fb17495ec6b/README.md#security-vulnerability-prior-to-v210","tags":["web"]},{"url":"https://github.com/flitbit/json-ptr/blob/master/src/util.ts%23L174","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038396","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-JSONPTR-1016939","tags":["web"]},{"url":"https://www.huntr.dev/bounties/2-npm-json-ptr/"},{"url":"https://www.npmjs.com/advisories/1706","tags":["web"]},{"url":"https://www.npmjs.com/package/json-ptr","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rrqv-vjrw-hrcr"},{"url":"https://www.huntr.dev/bounties/2-npm-json-ptr","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-rrqv-vjrw-hrcr","title":"Arbitrary Code Execution in json-ptr","description":"There is a security vulnerability in `json-ptr` versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.","status":"published","published":"2021-05-26T19:59:19Z","modified":"2023-01-09T05:05:26Z","cwes":["CWE-74"],"updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-rrqv-vjrw-hrcr","title":"Arbitrary Code Execution in json-ptr","description":"There is a security vulnerability in `json-ptr` versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.","status":"published","published":"2021-05-26T19:59:19Z","modified":"2021-05-26T19:57:10Z","cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}