Medium severity · published Jul 15, 2020
CVE-2020-15366
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2
5.6
CVSS
2.3%
EPSS
No
On KEV
Description
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AJ
Ajv · Ajv.js
6.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15366
Release Notes
https://github.com/ajv-validator/ajv/releases/tag/v6.12.3
Third Party Advisory
https://github.com/ajv-validator/ajv/tags
Permissions Required
https://hackerone.com/bugs?subject=user&report_id=894259
security.netapp.com
https://security.netapp.com/advisory/ntap-20240621-0007/
More from Ajv
2.9
CVE-2025-69873
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled