CVE-2026-15195

{"id": "CVE-2026-15195", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15195", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T18:22:56.575261Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:apidevtools:json-schema-ref-parser:*:*:*:*:*:*:*:*"], "vendor": "apidevtools", "product": "json-schema-ref-parser", "versions": [{"status": "affected", "version": "15.3.0"}, {"status": "affected", "version": "15.3.1"}, {"status": "affected", "version": "15.3.2"}, {"status": "affected", "version": "15.3.3"}, {"status": "affected", "version": "15.3.4"}, {"status": "affected", "version": "15.3.5"}, {"status": "unaffected", "version": "15.3.6"}]}]}], "published": "2026-07-09T18:16:51.313", "references": [{"url": "https://github.com/APIDevTools/json-schema-ref-parser/", "source": "cna@vuldb.com"}, {"url": "https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84", "source": "cna@vuldb.com"}, {"url": "https://github.com/APIDevTools/json-schema-ref-parser/issues/421", "source": "cna@vuldb.com"}, {"url": "https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-15195", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/851809", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/377123", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/377123/cti", "source": "cna@vuldb.com"}, {"url": "https://github.com/APIDevTools/json-schema-ref-parser/issues/421", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component."}, {"lang": "es", "value": "Se ha identificado una debilidad en apidevtools json-schema-ref-parser hasta la versi\u00f3n 15.3.5. Esto afecta a la funci\u00f3n Refs.set/Pointer.set en la biblioteca lib/pointer.ts. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a una modificaci\u00f3n indebidamente controlada de atributos de prototipo de objeto. El ataque puede lanzarse de forma remota. La actualizaci\u00f3n a la versi\u00f3n 15.3.6 solucionar\u00e1 este problema. Este parche se llama a786bc6afc3674f650496472ee93d5cf74c4bd84. Se sugiere actualizar el componente afectado."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "cna@vuldb.com"}