CVE-2026-16008mediumCWE-1321 CWE-94

CVE-2026-16008: medium-severity vulnerability in sagold json-schema-library

sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution

Published 17 Jul 2026

Follow this CVE + Monitor json-schema-library

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%

A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can be initiated remotely. Upgrading to version 11.6.0 will fix this issue. The identifier of the patch is 432287ee6f68a02ce6f015354618486ec427a32d. It is advisable to upgrade the affected component.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

sagold · json-schema-library

References

https://github.com/sagold/json-schema-library/https://github.com/sagold/json-schema-library/commit/432287ee6f68a02ce6f015354618486ec427a32d https://github.com/sagold/json-schema-library/issues/111 https://github.com/sagold/json-schema-library/releases/tag/v11.6.0 https://vuldb.com/cve/CVE-2026-16008 https://vuldb.com/submit/856721 https://vuldb.com/vuln/379752 https://vuldb.com/vuln/379752/cti