CVE-2020-15366
At a glance
- Severity
- Not available
- EPSS
- EPSS 2.31 % · percentile 83 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
Advisories
- GHSA-v88g-cgmw-v5xw — Prototype Pollution in Ajv
European references
- ENISA EUVD · EUVD-2022-1195
- GCVE · GCVE-0-2020-15366
CERT-FR advisories
- CERTFR-2026-AVI-1256 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0366 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0276 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-278 — Multiples vulnérabilités dans IBM Spectrum discover · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:ajv.js:ajv:6.12.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
References
- https://hackerone.com/bugs?subject=user&report_id=894259
- https://github.com/ajv-validator/ajv/tags
- https://github.com/ajv-validator/ajv/releases/tag/v6.12.3
- https://security.netapp.com/advisory/ntap-20240621-0007/
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |