Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-15195— apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

Quick assessment

Affected

apidevtools json-schema-ref-parser

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

API Dev Tools JSON Schema $Ref Parser是API Dev Tools组织开源的一个JSON Schema引用解析工具。 API Dev Tools JSON Schema $Ref Parser 15.3.5及之前版本存在安全漏洞，该漏洞源于lib/pointer.ts库中Refs.set/Pointer.set函数对对象原型属性的修改控制不当，可能导致远程攻击。

CVSS 6.3 · Medium EPSS 0.46% · P39 Updated Jul 10, 2026

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process

Affected Version Matrix 7

Vendor	Product	Version Range	Status
apidevtools	json-schema-ref-parser	`15.3.0`	affected
		`15.3.1`	affected
		`15.3.2`	affected
		`15.3.3`	affected
		`15.3.4`	affected
		`15.3.5`	affected
		`15.3.6`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15195

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

Source: CVE Program / CVE List V5

Vulnerability Description

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Vulnerability Title

API Dev Tools JSON Schema $Ref Parser 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
apidevtools	json-schema-ref-parser	15.3.0	`cpe:2.3:a:apidevtools:json-schema-ref-parser::::::::`

II. Public POCs for CVE-2026-15195

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-15195

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15195 (2)

Proof of Concept for CVE-2026-15195 (1)

🔗 Prototype pollution in public `$Refs.set()` / `Pointer.set()` path via JSON Pointer tokens · Issue #421 · APIDevTools/json-schema-ref-parser Read full article issue-tracking

Other References for CVE-2026-15195 (1)

🔗 GitHub - APIDevTools/json-schema-ref-parser: Parse, Resolve, and Dereference JSON Schema $ref pointers in Node and browsers · GitHub product

https://www.cve.org/CVERecord?id=CVE-2026-15195

IV. Related Vulnerabilities

Same weakness: CWE-1321