The vulnerability resides in the parsePropertyDependencies function of sagold json-schema-library versions 11.5.0 and 11.5.1. A maliciously crafted propertyDependencies keyword in a JSON schema causes the function to modify the JavaScript object prototype, creating a prototype pollution flaw (CWE‑1321). The code also performs dynamic evaluation of property names (CWE‑94), allowing an attacker to inject arbitrary properties into shared objects. This can lead to data tampering, privilege escalation or denial‑of‑service within any application that uses the library to validate schemas.

Sagold json-schema-library versions 11.5.0 and 11.5.1 are distributed via npm and used by Node.js projects, frameworks, or services that import this dependency and process user‑supplied JSON schemas. Any component that calls parsePropertyDependencies when validating schemas is vulnerable.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1 % suggests exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely by supplying a crafted JSON schema; no user interaction or local privileges are required. Attackers likely target any exposed schema‑validation endpoint or internal service that processes untrusted JSON data.