CVE-2021-23807

Name of the Vulnerable Software and Affected Versions jsonpointer versions prior to 5.0.0

Description A type confusion issue in the jsonpointer package can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. This can potentially allow a remote attacker to execute arbitrary code. The issue is related to errors in data type conversion.

Recommendations For versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the jsonpointer package until a patch is applied. Avoid using the jsonpointer package with array components in pointer paths until the issue is resolved.