Fluid Attacks Database

Description

Improper Control of Generation of Code in doT The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	dot	>=0 <1.1.3	1.1.3
debian 12	node-dot	>=0 <1.1.3+ds-1	1.1.3+ds-1
debian 14	node-dot	>=0 <1.1.3+ds-1	1.1.3+ds-1
debian 13	node-dot	>=0 <1.1.3+ds-1	1.1.3+ds-1

Aliases

1. CVE-2020-81412. NVD-2020-81413. OSV-2020-81414. OSV-DEBIAN-2020-81415. GCVE-2020-81416. SECURITY-TRACKER-CVE-2020-8141

References

1. https://hackerone.com/reports/390929

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.