Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm

GHSA-896r-f27r-55mw

CRITICAL

json-schema is vulnerable to Prototype Pollution

Also known asCVE-2021-3918
Published
Nov 19, 2021
Updated
Jan 17, 2025
Affected
1 pkg
Patched
1 / 1
Exploits
1 known

EPSS Exploitation Probability

via FIRST.org ↗
1.3%probability of exploitation in next 30 days
Lower Risk80th percentile0.00%
0.44%0.88%1.32%1.76%1.2%1.3%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected
📦json-schema

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

Description

json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmjson-schemaall versions0.4.0
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

json-schema is vulnerable to Improperly Controlled Modification of Objec…

huntr.devNVDNov 2021

Frequently Asked Questions

json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
O3 Security · Impact-Aware SCA

Is GHSA-896r-f27r-55mw in your stack?

O3 detects GHSA-896r-f27r-55mw across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works