This affects all versions of package json-ptr. The issue occurs in the set operation ( when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

Leave a comment