jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17479
Reference (s):
- https://blog.sonatype.com/cve-2020-17479
- https://github.com/manvel-khnkoyan/jpv/commit/e3eec1215caa8d5c560f5e88d0943422831927d6
- https://github.com/manvel-khnkoyan/jpv/issues/10
- https://www.npmjs.com/package/jpv