Bug 2501704 (CVE-2026-16008) - CVE-2026-16008 json-schema-library: json-schema-library: Remote Prototype Pollution Vulnerability
Summary: CVE-2026-16008 json-schema-library: json-schema-library: Remote Prototype Pol...
Keywords:
Status: NEW
Alias: CVE-2026-16008
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-17 11:01 UTC by OSIDB Bzimport
Modified: 2026-11-03 08:30 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-17 11:01:30 UTC 
A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can be initiated remotely. Upgrading to version 11.6.0 will fix this issue. The identifier of the patch is 432287ee6f68a02ce6f015354618486ec427a32d. It is advisable to upgrade the affected component.
Note You need to log in before you can comment on or make changes to this bug.