CVE-2020-7712: Joyent JSON

High severity, CVSS 7.2. EPSS: 3.1% chance of exploitation in the next 30 days.

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Affected products

• Joyent JSON: before 10.0.0 (fixed in 10.0.0)
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
• Oracle Financial Services Regulatory Reporting With Agilereporter: version 8.0.9.6.3 only
• Oracle Timesten In-Memory Database: before 21.1.1.1.0 (fixed in 21.1.1.1.0)

Published 2020-08-30. Last modified 2026-10-08.