GHSA-ff7x-qrg7-qggm

dot-prop Prototype Pollution vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2020-8116

Packages

Ecosystem	Package	Affected	Fixed in
npm	dot-prop	< 4.2.1	4.2.1
npm	dot-prop	>= 5.0.0, < 5.1.1	5.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-8116 advisory
https://github.com/sindresorhus/dot-prop/issues/63 web
https://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2 web
https://github.com/sindresorhus/dot-prop/commit/c914124f418f55edea27928e89c94d931babe587 web
https://hackerone.com/reports/719856 web
https://github.com/advisories/GHSA-ff7x-qrg7-qggm advisory
https://github.com/sindresorhus/dot-prop package
https://github.com/sindresorhus/dot-prop/tree/v4 web