Prototype Pollution Vulnerability in JSON5 Library: What You Need to Know

This post covers a historical JSON5 security advisory, CVE-2022-46175. It remains useful because it shows how a small parsing detail can matter when data from an untrusted source is later used in a trusted decision.

What the advisory affected

The JSON5 advisory states that affected versions of the json5 npm package could parse a __proto__ key and pollute the prototype of the object returned by JSON5.parse. The issue affected versions >= 2.0.0, < 2.2.2 and versions below 1.0.2. The project published fixes in 2.2.2 and 1.0.2 respectively.[1]

This was not the usual case of modifying the global Object prototype. The risk was attached to the parsed object itself. If an application later used that object in trusted operations, unexpected inherited values could affect authorization or other sensitive logic.[1]

Why the pattern matters

The issue is a reminder that validation must match the way an application uses data. Checking only an object’s own keys may not be enough when prototype inheritance, object merging, or permissive parsing are involved.

The impact of a parsing flaw depends on context. It can be limited in one application and serious in another. The advisory lists possible impacts including denial of service, cross-site scripting, elevation of privilege, and, in extreme cases, remote code execution.[1]

What to do now

If a project still uses JSON5, start with evidence rather than assumptions:

1. Check lockfiles and deployed dependency inventories for the resolved JSON5 version.
2. Upgrade affected 2.x installations to 2.2.2 or later, and affected 1.x installations to 1.0.2 or later.
3. Test the application after the dependency change.
4. Review code paths that parse untrusted input and then use the result in authorization, configuration, or other trusted operations.
5. Keep dependency alerts and ownership in place so future advisories have a clear path to review.

This is not a reason to panic about every JSON5 use. It is a reason to know which version is deployed and how parsed data flows through the application.

If your team needs a clearer process for dependency inventory, vulnerability triage, or secure application review, contact us or review our cybersecurity consulting service.

References

1. JSON5 GitHub Security Advisory, GHSA-9c47-m6qq-7p4h

TODO(author): Approve a shorter title, such as “JSON5 prototype pollution vulnerability.” The current title exceeds the repository’s 60-character convention.