CVE-2026-15195

apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

State: Published
Severity: 5.3 Medium
Published: Jul 9, 2026
Updated: Nov 2, 2026
Reserved: Jul 9, 2026

Description

A weakness has been identified in apidevtools json-schema-ref-parser. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component. The project maintainer confirms: "I reproduced prototype pollution through the public $Refs.set() API in published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5. The same pointer is rejected by 15.3.6 without modifying Object.prototype. This reported path requires an application to pass an attacker-controlled pointer to $Refs.set(); dependency presence alone does not establish exploitability."

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
CWE-94 Code Injection

Affected Products

Product	Versions
json-schema-ref-parserapidevtools	7.1.4Affected 8.0.0Affected 9.0.0Affected 9.0.1Affected 9.0.2Affected 9.0.3Affected 9.0.5Affected 9.0.6Affected 9.0.7Affected 9.0.8Affected 9.0.9Affected 9.1.0Affected 9.1.2Affected 10.0.0Affected 10.0.1Affected 10.1.0Affected 11.0.0Affected 11.1.0Affected 11.1.1Affected 11.2.0Affected 11.2.1Affected 11.2.2Affected 11.2.3Affected 11.2.4Affected 11.3.0Affected and 57 more versions

References

VDB-377123 | apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollutionvdb-entrytechnical-description
VDB-377123 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-15195 | CVE Analysis and Reportthird-party-advisory
Submit #851809 | Node.js @apidevtools/json-schema-ref-parser 15.3.5 Improperly Controlled Modification of Object Prototype Attributethird-party-advisory
https://github.com/APIDevTools/json-schema-ref-parser/issues/421issue-tracking
https://github.com/APIDevTools/json-schema-ref-parser/issues/421#issuecomment-6547659739issue-tracking
https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84patch
https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6patch
https://github.com/APIDevTools/json-schema-ref-parser/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.