Skip to content
Fencer Intel
medium 5.6

CVE-2020-15366 json

Prototype Pollution in Ajv

published 6y ago modified 4mo ago also GHSA-v88g-cgmw-v5xw , EUVD-2022-1195

cvss
5.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Patch / fix

  • npm ajv 6.12.3
  • node-ajv Debian 14, Debian 13, Debian 12 6.12.4-1

debian advisories DEBIAN-CVE-2020-15366

  • python-bleach ansible automation platform 4.2 3.3.0-1.el7pc
  • python-bleach ansible automation platform 4.2 3.3.0-1.el8pc
  • automation-hub ansible automation platform 4.2 4.2.2-1.el7pc
  • automation-hub ansible automation platform 4.2 4.2.2-1.el8pc
  • python3-bleach ansible automation platform 4.2 3.3.0-1.el7pc
  • python3-bleach ansible automation platform 4.2 3.3.0-1.el8pc
  • python3-django ansible automation platform 4.2 2.2.18-1.el7pc
  • python3-django ansible automation platform 4.2 2.2.18-1.el8pc

red hat advisories RHSA-2021:0781RHSA-2021:0551RHSA-2020:5305RHSA-2021:0421RHSA-2021:0548RHSA-2021:0521

  • nodejs-nodemon AlmaLinux 8 2.0.3-1.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.5.0+254+b4526b16
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3

almalinux advisories ALSA-2021:0551ALSA-2021:0548ALSA-2020:5499

  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.6.0+982+9fdca2d4
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.3.0+100+234774f7
  • nodejs-nodemon Rocky Linux 8 2.0.3-1.module+el8.4.0+638+5344c6f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
  • nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
  • nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154

rocky linux advisories RLSA-2021:0551RLSA-2021:0548RLSA-2020:5499

Is CVE-2020-15366 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-15366 updated cvss 5.6

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

  • Red Hat OpenShift Service Mesh 1 kiali, servicemesh-grafana, servicemesh-grafana-prometheus Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Container Platform 4 openshift4/ose-grafana
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Virtualization 1 kubevirt-web-ui
    affected: no fix planned “Will not fix”
  • Red Hat Quay v3 quay/quay-rhel8 v3.6.0-62
    fixed: vendor fix RHSA-2021:3917
  • Red Hat Automation Hub 4.2 for RHEL 7 python-bleach 3.3.0-1.el7pc, automation-hub 4.2.2-1.el7pc, python3-bleach 3.3.0-1.el7pc, python3-django 2.2.18-1.el7pc, python-galaxy-ng 4.2.2-1.el7pc, python3-galaxy-ng 4.2.2-1.el7pc, +6 more Red Hat Automation Hub 4.2 for RHEL 8 python-bleach 3.3.0-1.el8pc, automation-hub 4.2.2-1.el8pc, python3-bleach 3.3.0-1.el8pc, python3-django 2.2.18-1.el8pc, python-galaxy-ng 4.2.2-1.el8pc, python3-galaxy-ng 4.2.2-1.el8pc, +6 more
    fixed: vendor fix RHSA-2021:0781
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.23.1-1.module+el8.3.0+9502+012d8a97, nodejs 12.19.1-1.module+el8.3.0+8851+b7b41ca0, nodejs 14.15.4-2.module+el8.3.0+9635+ffdf8381, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, +9 more
    fixed: vendor fix RHSA-2021:0548
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-console v4.6.0-202010100121.p0, openshift4/ose-prometheus v4.6.0-202009290409.p0
    fixed: vendor fix RHSA-2020:4298
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.19.1-2.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs12-npm 6.14.8-12.19.1.2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7
    fixed: vendor fix RHSA-2021:0521
  • Red Hat Quay v3 quay/clair-rhel8 v3.6.0-70, quay/quay-builder-rhel8 v3.6.0-44, quay/quay-operator-rhel8 v3.6.0-43, quay/quay-operator-bundle v3.6.0-48, quay/quay-bridge-operator-rhel8 v3.6.0-40, quay/quay-bridge-operator-bundle v3.6.0-35, +3 more Red Hat OpenShift Container Platform 4.6 openshift4/ose-cli v4.6.0-202010080605.p0, openshift4/ose-ptp v4.6.0-202010200139.p0, openshift4/ose-etcd v4.6.0-202010061132.p0, openshift4/ose-tests v4.6.0-202010120952.p0, openshift4/ose-coredns v4.6.0-202010061132.p0, openshift4/ose-grafana v4.6.0-202010061132.p0, +78 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.31% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm ajv
<6.12.3
6.12.3

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.