CVE-2020-15366

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

• CWE-1321

• https://github.com/ajv-validator/ajv/releases/tag/v6.12.3Release Notes, Third Party Advisory
• https://github.com/ajv-validator/ajv/tagsThird Party Advisory
• https://hackerone.com/bugs?subject=user&report_id=894259Permissions Required
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://github.com/ajv-validator/ajv/releases/tag/v6.12.3Release Notes, Third Party Advisory
• https://github.com/ajv-validator/ajv/tagsThird Party Advisory
• https://hackerone.com/bugs?subject=user&report_id=894259Permissions Required
• https://security.netapp.com/advisory/ntap-20240621-0007/

Published

Jul 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1536An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15360com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege…7.8
• CVE-2020-15362wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code I…9.8
• CVE-2020-15363The Nexos theme through 1.7 for WordPress allows side-map/?s…9.8
• CVE-2020-15364The Nexos theme through 1.7 for WordPress allows top-map/?se…6.1
• CVE-2020-15365LibRaw before 0.20-Beta3 has an out-of-bounds write in parse…6.5
• CVE-2020-15367Venki Supravizio BPM 10.1.2 does not limit the number of aut…9.8
• CVE-2020-15368AsrDrv103.sys in the ASRock RGB Driver does not properly res…5.5
• CVE-2020-15369Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through…8.8
• CVE-2020-1537An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15370Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g …6.5
• CVE-2020-15371Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, …9.8