CVE-2022-36010: This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionVal

This week

CRITICAL 10.0REMOTEUPGRADE

CVE-2022-36010 is a critical-severity flaw (CVSS 10.0) affecting react editable json tree. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). To do this, Javascript's [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function is used to execute strings that begin with "function" as Javascrip

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.5% (top 26%)
CISA exploited list	No
Weakness	CWE-95
Published	2022-08-15
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: react editable json tree project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-08-15 19:15 UTCPublished CVE record published
2026-06-17 04:52 UTCUpdated Record last modified

react editable json tree project react editable json tree UPGRADE

Affected: < 2.2.2

Fixed in: 2.2.2

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls react-editable-json-tree

2. UPGRADE to 2.2.2

npm install react-editable-json-tree@">=2.2.2"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-36010?

react editable json tree: upgrade to 2.2.2. Exact commands for each OS are on this page.

Is CVE-2022-36010 being exploited?

CVE-2022-36010 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-36010 affect?

CVE-2022-36010 affects react editable json tree. Severity is critical (CVSS 10.0). This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunct

How urgent is CVE-2022-36010?

Priority 63/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

React vulnerabilities · GitHub vulnerabilities

References

← Back to latest CVEs