CVE-2026-15195 apidevtools CVE debrief

Who should care

Defenders responsible for apidevtools json-schema-ref-parser should assess exposure and prioritize upgrading to version 15.3.6. This involves verifying inventory for exposure and monitoring for potential exploitation attempts. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize upgrading affected components and verify inventory for exposure due to potential prototype pollution.

• Potential for prototype pollution through $Refs.set() API
• Exposure requires an application to pass an attacker-controlled pointer

Technical summary

The weakness in apidevtools json-schema-ref-parser allows improper control of object prototype attributes through the Refs.set/Pointer.set function in lib/pointer.ts. This weakness can lead to prototype pollution through the $Refs.set() API. The project maintainer confirms that published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5 are affected, while version 15.3.6 is not. Upgrading to version 15.3.6 will fix this issue. This issue requires an application to pass an attacker-controlled pointer to $Refs.set(); dependency presence alone does not establish exploitability.

Defensive priority

Defenders should prioritize upgrading affected components and verify inventory for exposure.

Recommended defensive actions

• Upgrade affected components to version 15.3.6
• Verify inventory for exposure
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The project maintainer confirms reproducing prototype pollution through the public $Refs.set() API in published versions 7.1.4, 9.0.0, 11.0.0, 14.0.0, 14.2.1, 15.3.0, and 15.3.5. The same pointer is rejected by 15.3.6 without modifying Object.prototype. This reported path requires an application to pass an attacker-controlled pointer to $Refs.set(); dependency presence alone does not establish exploitability. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.