[GHSA-7mg4-w3w5-x5pc] Prototype pollution in json-pointer

[Wenxin-Jiang]

Updates

• Affected products

Comments
The prototype-pollution sink requires api.set() to traverse into an inherited property like __proto__ or constructor.prototype.

In 0.0.2–0.2.2, the traversal is gated by !obj.hasOwnProperty(tok), which is false for inherited names. The code therefore enters the create branch and executes obj['__proto__'] = {}, replacing the local object's prototype with a fresh {} instead of navigating into Object.prototype.

Global pollution is not reachable through any of the three standard vectors:

• __proto__
• constructor.prototype
• prototype

The exploitable shape first appears in 0.3.0, when the guard was rewritten to !(tok in obj), which treats inherited properties as present and thus navigates into them.

Fix commit 1dbd1ed (PR #34) is written against that 0.3.0+ shape.