A weakness has been identified in apidevtools json-schema-ref-parser that affects the Refs.set and Pointer.set functions in lib/pointer.ts; supply of a malicious schema can cause the library to write to Object.prototype unconditionally. This prototype pollution is a CWE-1321 vulnerability that may persist after the initial exploit and alter the behavior of any JavaScript code that runs in the same runtime. The defect does not require code execution or elevated privileges to be triggered, but it enables an attacker to influence global object behavior, potentially leading to subsequent denial‑of‑service or arbitrary code execution scenarios.

All deployments that use apidevtools json-schema-ref-parser up to and including version 15.3.5 are impacted. The failure is triggered when a parsed schema contains a $ref or other reference that the library resolves via the Pointer.set routine; any environment that processes externally supplied JSON Schema documents with the vulnerable library is exposed.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% suggests the likelihood of exploitation is low but not impossible. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can launch the attack remotely by supplying a crafted schema to the library without authentication. Because prototype pollution can change global behavior, an affected server or application may become a vector for additional attacks once the prototype is altered.