CVE-2021-3918: Prototype Pollution in kriszyp/json-schema
Vulnerability summary
CVE-2021-3918 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 3.83% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 29 · Related 20Timeline
- 13-11-2021PublishedVulnerability first disclosed.
- 17-01-2025Last modifiedVulnerability information updated.
Description
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.83%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.83% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- node-json-schema< 0.2.3-1+deb10u1 | < 0.4.0+~7.0.9-1
- debian_linuxEOL10.0
Json-schema_project1 product
- json-schema< 0.4.0
Kriszyp1 product
- kriszyp/json-schema≥ unspecified, ≤ 0.3.0
Mageia1 product
- nodejs-json-schema< 0.2.3-3.1.mga8
Npm1 product
- json-schema< 0.4.0
Ubuntu1 product
- node-json-schema< 0.2.3-1+deb10u1build0.18.04.1 | < 0.2.3-1+deb10u1build0.20.04.1
6 vendors · 7 products
References
16 links- huntr.dev/bounties/bb6ccd63-f505-4e3a-b55f-cd2662c261a9REPORTWEBExploitIssue TrackingPatchThird Party Advisory
- github.com/kriszyp/json-schema/commit/22f146111f541d9737e832823699ad3528ca7741REPORTWEBPatchThird Party Advisory
