CVE-2025-57320 Details
Description
json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
A prototype pollution vulnerability has been identified in the json-schema-editor-visual package, specifically in versions through 1.1.1. The issue arises in the setData and deleteData functions, where improper validation of property paths allows attackers to inject or delete properties on Object.prototype. This manipulation can lead to denial-of-service conditions, as the minimum consequence.
Users are advised to update to version 2.0.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| open-federation json-schema-editor-visual | <= 1.1.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Sep 25, 2025 | CVE Modified | CISA-ADP |
| Sep 24, 2025 | New CVE Received | [email protected] |