{"id":"CVE-2026-15195","summary":"apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution","details":"A weakness has been identified in apidevtools json-schema-ref-parser. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component. The project maintainer confirms: \"I reproduced prototype pollution through the public $Refs.set() API in published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5. The same pointer is rejected by 15.3.6 without modifying Object.prototype. This reported path requires an application to pass an attacker-controlled pointer to $Refs.set(); dependency presence alone does not establish exploitability.\"","modified":"2026-11-04T02:30:27.771707929Z","published":"2026-07-09T17:15:08.989Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-1321","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15195.json"},"references":[{"type":"WEB","url":"https://github.com/APIDevTools/json-schema-ref-parser/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15195.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15195"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-15195"},{"type":"ADVISORY","url":"https://vuldb.com/submit/851809"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/377123"},{"type":"REPORT","url":"https://github.com/APIDevTools/json-schema-ref-parser/issues/421"},{"type":"REPORT","url":"https://github.com/APIDevTools/json-schema-ref-parser/issues/421#issuecomment-6547659739"},{"type":"REPORT","url":"https://vuldb.com/vuln/377123/cti"},{"type":"FIX","url":"https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84"},{"type":"FIX","url":"https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apidevtools/json-schema-ref-parser","events":[{"introduced":"da3f4e6d9680c910b62d706af0d468e45b300448"},{"fixed":"a786bc6afc3674f650496472ee93d5cf74c4bd84"},{"fixed":"5b1aee585ca0a603f72ec90d51225a535ea8da5f"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"7.1.4"},{"last_affected":"7.1.4"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"8.0.0"},{"last_affected":"8.0.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"9.0.0"},{"last_affected":"9.0.0"}]},{"range":[{"introduced":"9.0.1"},{"last_affected":"9.0.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"9.0.2"},{"last_affected":"9.0.2"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"9.0.3"},{"last_affected":"9.0.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"9.0.5"},{"last_affected":"9.0.5"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"9.0.6"},{"last_affected":"9.0.6"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"9.0.7"},{"last_affected":"9.0.7"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"9.0.8"},{"last_affected":"9.0.8"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"9.0.9"},{"last_affected":"9.0.9"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"9.1.0"},{"last_affected":"9.1.0"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"9.1.2"},{"last_affected":"9.1.2"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"10.0.0"},{"last_affected":"10.0.0"}]},{"range":[{"introduced":"10.0.1"},{"last_affected":"10.0.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"10.1.0"},{"last_affected":"10.1.0"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.0.0"},{"last_affected":"11.0.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.1.0"},{"last_affected":"11.1.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.1.1"},{"last_affected":"11.1.1"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.2.0"},{"last_affected":"11.2.0"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"11.2.1"},{"last_affected":"11.2.1"}]},{"range":[{"introduced":"11.2.2"},{"last_affected":"11.2.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.2.3"},{"last_affected":"11.2.3"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"11.2.4"},{"last_affected":"11.2.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.3.0"},{"last_affected":"11.3.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.4.0"},{"last_affected":"11.4.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"11.4.1"},{"last_affected":"11.4.1"}]},{"range":[{"introduced":"11.4.2"},{"last_affected":"11.4.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.5.0"},{"last_affected":"11.5.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"11.5.1"},{"last_affected":"11.5.1"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"11.5.2"},{"last_affected":"11.5.2"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.5.3"},{"last_affected":"11.5.3"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"11.5.4"},{"last_affected":"11.5.4"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.5.5"},{"last_affected":"11.5.5"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"11.6.0"},{"last_affected":"11.6.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.6.1"},{"last_affected":"11.6.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.6.2"},{"last_affected":"11.6.2"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.6.3"},{"last_affected":"11.6.3"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"11.6.4"},{"last_affected":"11.6.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.6.5"},{"last_affected":"11.6.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.7.0"},{"last_affected":"11.7.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.7.1"},{"last_affected":"11.7.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"11.7.2"},{"last_affected":"11.7.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.7.3"},{"last_affected":"11.7.3"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.8.2"},{"last_affected":"11.8.2"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.9.0"},{"last_affected":"11.9.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"11.9.1"},{"last_affected":"11.9.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"11.9.2"},{"last_affected":"11.9.2"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"11.9.3"},{"last_affected":"11.9.3"}]},{"range":[{"introduced":"12.0.0"},{"last_affected":"12.0.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"12.0.1"},{"last_affected":"12.0.1"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"12.0.2"},{"last_affected":"12.0.2"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"13.0.0"},{"last_affected":"13.0.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"13.0.1"},{"last_affected":"13.0.1"}]},{"range":[{"introduced":"13.0.2"},{"last_affected":"13.0.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"13.0.3"},{"last_affected":"13.0.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"13.0.4"},{"last_affected":"13.0.4"}]},{"range":[{"introduced":"13.0.5"},{"last_affected":"13.0.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"14.0.0"},{"last_affected":"14.0.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"14.0.1"},{"last_affected":"14.0.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"14.0.2"},{"last_affected":"14.0.2"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"14.0.3"},{"last_affected":"14.0.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"14.1.0"},{"last_affected":"14.1.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"14.1.1"},{"last_affected":"14.1.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"14.2.0"},{"last_affected":"14.2.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"14.2.1"},{"last_affected":"14.2.1"}]},{"range":[{"introduced":"15.0.0"},{"last_affected":"15.0.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"15.0.1"},{"last_affected":"15.0.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"15.1.0"},{"last_affected":"15.1.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"15.1.1"},{"last_affected":"15.1.1"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"15.1.2"},{"last_affected":"15.1.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"15.1.3"},{"last_affected":"15.1.3"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"15.2.0"},{"last_affected":"15.2.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"15.2.1"},{"last_affected":"15.2.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"15.2.2"},{"last_affected":"15.2.2"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"15.3.0"},{"last_affected":"15.3.0"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"15.3.1"},{"last_affected":"15.3.1"}]},{"range":[{"introduced":"15.3.2"},{"last_affected":"15.3.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"15.3.3"},{"last_affected":"15.3.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"15.3.4"},{"last_affected":"15.3.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"15.3.5"},{"last_affected":"15.3.5"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"a786bc6afc3674f650496472ee93d5cf74c4bd84"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v15.3.6","range":[{"fixed":"5b1aee585ca0a603f72ec90d51225a535ea8da5f"}],"source":"REFERENCES_TAG"}]}}],"versions":["10.0.0","10.0.1","10.1.0","11.0.0","11.1.0","11.1.1","11.2.0","11.2.1","11.2.2","11.2.3","11.2.4","11.3.0","11.4.0","11.4.1","11.4.2","11.5.0","11.5.1","11.5.2","11.5.3","11.5.4","11.5.5","11.6.0","11.6.1","11.6.2","11.6.3","11.6.4","11.6.5","11.7.0","11.7.1","11.7.2","11.7.3","11.8.2","11.9.0","11.9.1","11.9.2","11.9.3","12.0.0","12.0.1","12.0.2","13.0.0","13.0.1","13.0.2","13.0.3","13.0.4","13.0.5","14.0.0","14.0.1","14.0.2","14.0.3","14.1.0","14.1.1","14.2.0","14.2.1","15.0.0","15.0.1","15.1.0","15.1.1","15.1.2","15.1.3","15.2.0","15.2.1","15.2.2","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","15.3.5","7.1.4","8.0.0","9.0.0","9.0.1","9.0.2","9.0.3","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15195.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}