CVE-2026-15195

A weakness has been identified in apidevtools json-schema-ref-parser. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component. The project maintainer confirms: "I reproduced prototype pollution through the public $Refs.set() API in published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5. The same pointer is rejected by 15.3.6 without modifying Object.prototype. This reported path requires an application to pass an attacker-controlled pointer to $Refs.set(); dependency presence alone does not establish exploitability."

• CWE-94
• CWE-1321

• https://github.com/APIDevTools/json-schema-ref-parser/
• https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84
• https://github.com/APIDevTools/json-schema-ref-parser/issues/421
• https://github.com/APIDevTools/json-schema-ref-parser/issues/421#issuecomment-6547659739
• https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6
• https://vuldb.com/cve/CVE-2026-15195
• https://vuldb.com/submit/851809
• https://vuldb.com/vuln/377123
• https://vuldb.com/vuln/377123/cti
• https://github.com/APIDevTools/json-schema-ref-parser/issues/421

Published

Jul 9, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1519If a BIND resolver is performing DNSSEC validation and encou…7.5
• CVE-2026-15190A vulnerability was detected in SourceCodester Simple and Ni…7.3
• CVE-2026-15191A flaw has been found in mettle sendportal up to 3.0.1. This…6.3
• CVE-2026-15192A vulnerability has been found in mettle sendportal up to 3.…6.5
• CVE-2026-15193A vulnerability was determined in AidanPark openclaw-android…5.3
• CVE-2026-15194A security flaw has been discovered in Open5GS 2.7.7. This a…3.3
• CVE-2026-15198A missing authentication for critical functionality vulnerab…6.5
• CVE-2026-1520A vulnerability was identified in rethinkdb up to 2.4.3. Aff…2.4
• CVE-2026-15201An improper certificate validation vulnerability in the Supp…5.9
• CVE-2026-15202A security vulnerability has been detected in YzmCMS up to 7…4.3
• CVE-2026-15203Improper access control in debug and engineering interfaces …9.3
• CVE-2026-15204A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415…5.3