Description
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Remediation
References
https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e
https://snyk.io/vuln/SNYK-JS-JSON8-1017116
Related Vulnerabilities
CVE-2021-22569 Vulnerability in maven package com.google.protobuf:protobuf-java
CVE-2020-36321 Vulnerability in maven package com.vaadin:flow-server
CVE-2016-5019 Vulnerability in maven package org.apache.myfaces.trinidad:trinidad-impl
CVE-2022-40149 Vulnerability in maven package org.codehaus.jettison:jettison
CVE-2021-27578 Vulnerability in maven package org.apache.zeppelin:zeppelin