What is GHSA-vh6r-g38f-q3w8?

GHSA-vh6r-g38f-q3w8 is a security advisory published by GitHub Security Advisories with Critical severity. Validation bypass in jpv

Which CVE IDs does GHSA-vh6r-g38f-q3w8 cover?

GHSA-vh6r-g38f-q3w8 covers the following CVE IDs: CVE-2020-17479. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vh6r-g38f-q3w8?

GHSA-vh6r-g38f-q3w8 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-vh6r-g38f-q3w8?

GHSA-vh6r-g38f-q3w8 affects 1 product, including: npm/jpv:\u003c 2.2.2.

GHSA-vh6r-g38f-q3w8CriticalCVSS 9.8

Validation bypass in jpv

Vendor

GitHub Security Advisories

Published

May 6, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-17479 →

📋 Description

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.

🎯 Affected products1

npm/jpv:< 2.2.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-17479
https://github.com/manvel-khnkoyan/jpv/issues/10
https://github.com/manvel-khnkoyan/jpv/commit/e3eec1215caa8d5c560f5e88d0943422831927d6
https://blog.sonatype.com/cve-2020-17479
https://www.npmjs.com/package/jpv
https://github.com/advisories/GHSA-vh6r-g38f-q3w8