CVE-2026-16008

Katalog CVE

CVSS 6.3 · Medium EPSS 0,46%

Kerentanan Improper Control of Generation of Code ('Code Injection'). Skor CVSS 3.1 6.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can be initiated remotely. Upgrading to version 11.6.0 will fix this issue. The identifier of the patch is 432287ee6f68a02ce6f015354618486ec427a32d. It is advisable to upgrade the affected component.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Deferred

CVSS 3.1

6.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/sagold/json-schema-library/
• https://github.com/sagold/json-schema-library/commit/432287ee6f68a02ce6f015354618486ec427a32d
• https://github.com/sagold/json-schema-library/issues/111
• https://github.com/sagold/json-schema-library/releases/tag/v11.6.0
• https://vuldb.com/cve/CVE-2026-16008
• https://vuldb.com/submit/856721
• https://vuldb.com/vuln/379752
• https://vuldb.com/vuln/379752/cti