~ / search / GHSA-297x-8xj4-vcxv

GHSA-297x-8xj4-vcxv

Improper Control of Generation of Code in doT

Source: GitHub Advisory Database (reviewed) High CVE-2020-8141

Packages

EcosystemPackageAffectedFixed in
npm dot < 1.1.3 1.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

References

External links from the advisory. They lead to third-party sites.