VYPR
← All advisories
Critical severityNVD Advisory· Published Nov 13, 2021· Updated Jan 17, 2025

Prototype Pollution in kriszyp/json-schema

CVE-2021-3918

Description

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A prototype pollution vulnerability in json-schema allows attackers to pollute Object.prototype via crafted schema definitions.

Vulnerability

According to the NVD entry [1], json-schema is vulnerable to prototype pollution. The validate function iterates over properties of objTypeDef without filtering out __proto__ or constructor. This allows a malicious schema to define a __proto__ property with a default value, which will be assigned to the instance's prototype during validation. Affected are all versions prior to commit 22f1461 [2].

Exploitation

An attacker can supply a crafted JSON schema that includes a __proto__ property with a default value. When the validate function processes an instance object, it sets the default value on the instance's __proto__, thereby polluting Object.prototype. No authentication or special privileges are required; the attacker only needs to provide the malicious schema to an application that uses json-schema for validation.

Impact

Successful exploitation results in prototype pollution, allowing the attacker to inject arbitrary properties into Object.prototype. This can lead to property injection, denial of service, or other security issues depending on how the application uses the polluted properties. The impact is limited to the scope of the application's use of the polluted prototype.

Mitigation

The vulnerability is fixed in commit 22f1461 [2], which adds a check i != '__proto__'. A subsequent commit f6f6a3b [4] also filters constructor and uses hasOwnProperty for safer property access. Users should update to a version that includes these fixes. The repository is considered finished and does not implement the latest JSON Schema specifications [3]; users may consider migrating to a maintained implementation.

References
  1. NVD - CVE-2021-3918
  2. Don't allow __proto__ property to be used for schema default/coerce, … · kriszyp/json-schema@22f1461
  3. GitHub - kriszyp/json-schema: JSON Schema specifications, reference schemas, and a CommonJS implementation
  4. Use a little more robust method of checking instances · kriszyp/json-schema@f6f6a3b

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
json-schemanpm
< 0.4.00.4.0

Affected products

182

Patches

3
f6f6a3b02d66

Use a little more robust method of checking instances

https://github.com/kriszyp/json-schemaKris ZypNov 2, 2021via ghsa
commit
1 file changed · +1 −1
  • lib/validate.js+1 −1 modified
    @@ -208,7 +208,7 @@ var validate = exports._validate = function(/*Any*/instance,/*Object*/schema,/*O
 			
 			for(var i in objTypeDef){ 
 				if(objTypeDef.hasOwnProperty(i) && i != '__proto__' && i != 'constructor'){
-					var value = instance[i];
+					var value = instance.hasOwnProperty(i) ? instance[i] : undefined;
 					// skip _not_ specified properties
 					if (value === undefined && options.existingOnly) continue;
 					var propDef = objTypeDef[i];
b62f1da1ff54

Protect against constructor modification, #84

https://github.com/kriszyp/json-schemaKris ZypNov 2, 2021via ghsa
commit
1 file changed · +1 −1
  • lib/validate.js+1 −1 modified
    @@ -207,7 +207,7 @@ var validate = exports._validate = function(/*Any*/instance,/*Object*/schema,/*O
 			}
 			
 			for(var i in objTypeDef){ 
-				if(objTypeDef.hasOwnProperty(i) && i != '__proto__'){
+				if(objTypeDef.hasOwnProperty(i) && i != '__proto__' && i != 'constructor'){
 					var value = instance[i];
 					// skip _not_ specified properties
 					if (value === undefined && options.existingOnly) continue;
22f146111f54

Don't allow __proto__ property to be used for schema default/coerce, fixes #84

https://github.com/kriszyp/json-schemaKris ZypOct 9, 2021via ghsa
commit
3 files changed · +29 −1
  • .gitignore+2 −0 modified
    @@ -1 +1,3 @@
 node_modules
+yarn.lock
+.vscode
\ No newline at end of file
  • lib/validate.js+1 −1 modified
    @@ -207,7 +207,7 @@ var validate = exports._validate = function(/*Any*/instance,/*Object*/schema,/*O
 			}
 			
 			for(var i in objTypeDef){ 
-				if(objTypeDef.hasOwnProperty(i)){
+				if(objTypeDef.hasOwnProperty(i) && i != '__proto__'){
 					var value = instance[i];
 					// skip _not_ specified properties
 					if (value === undefined && options.existingOnly) continue;
  • test/tests.js+26 −0 modified
    @@ -92,4 +92,30 @@ var suite = vows.describe('JSON Schema').addBatch({
     'Json-Ref self-validates': assertSelfValidates('json-ref'),
     'Json-Ref/Hyper': assertValidates('json-ref', 'hyper-schema'),
     'Json-Ref/Core': assertValidates('json-ref', 'schema')*/
+    prototypePollution: function() {
+        console.log('testing')
+        const instance = JSON.parse(`
+        {
+        "$schema":{
+            "type": "object",
+            "properties":{
+            "__proto__": {
+                "type": "object",
+                
+                "properties":{
+                "polluted": {
+                    "type": "string",
+                    "default": "polluted"
+                }
+                }
+            }
+            },
+            "__proto__": {}
+        }
+        }`);
+
+        const a = {};
+        validate(instance);
+        assert.equal(a.polluted, undefined);
+    }
 }).export(module);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.