AIKIDO-2026-523065
@apidevtools/json-schema-ref-parser is vulnerable to Prototype Pollution
35
Low Risk
This Affects:
@apidevtools/json-schema-ref-parserTL;DR
When dereferencing or bundling schemas, the library merges the properties of an extended $ref and its resolved target using direct property assignment. Keys taken from externally influenced schema content, including __proto__, are copied without safe handling, so a crafted $ref object can reach Object.prototype. This lets untrusted schema input pollute prototypes during normal dereference and merge operations. The fix defines merged keys as own data properties so prototype-polluting keys can no longer mutate the prototype chain.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you dereference or bundle JSON Schema documents whose content is untrusted or externally influenced.
Background info
@apidevtools/json-schema-ref-parser is vulnerable to Prototype Pollution in versions 7.1.4 - 15.5.0.
How to fix this
Upgrade the @apidevtools/json-schema-ref-parser library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant