Detections
Analytics

SCA: security update for json5 (GHSA-9c47-m6qq-7p4h)

high Tenable Self-Hosted Container Security Plugin ID 413187

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand
 (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and
 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute
 the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by
 `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of
 Prototype Pollution. However, polluting the prototype of a single object can have significant security
 impact for an application if the object is later used in trusted operations. This vulnerability could
 allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The
 actual impact will depend on how applications utilize the returned object and how they filter unwanted
 keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme
 cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON
 strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores
 `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this
 vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later. (CVE-2022-46175)

See Also

https://github.com/advisories/GHSA-9c47-m6qq-7p4h

Plugin Details

Severity: High

ID: 413187

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.95

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-46175

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/29/2022

Vulnerability Publication Date: 12/24/2022

Reference Information

CVE: CVE-2022-46175