Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-46175

Quick assessment

Affected
json5 json5
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri 2.2.1版本及之前版本存在安全漏洞，该漏洞源于parse方法不限制名为“__proto__”键的解析，从而允许特制的字符串污染生成对象的原型。

CVSS 7.1 · High EPSS 9.70% · P95
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-46175

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5
Vulnerability Title
Tauri 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri 2.2.1版本及之前版本存在安全漏洞，该漏洞源于parse方法不限制名为“__proto__”键的解析，从而允许特制的字符串污染生成对象的原型。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
json5 json5 < 2.2.2 -

II. Public POCs for CVE-2022-46175

# POC Description Source Link Shenlong Link
1 Reproduction for CVE-2022-46175 https://github.com/giz-berlin/quasar-app-webpack-json5-vulnerability POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-46175

请登录查看更多情报信息。

Vendor Advisories for CVE-2022-46175 (1)

Mailing List Discussions for CVE-2022-46175 (1)

Other References for CVE-2022-46175 (2)

IV. Related Vulnerabilities

Same weakness: CWE-1321