Command Injection in dot

Description

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object’s prototype.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.2

References

• GHSA-4859-gpc7-4j66
• hackerone.com
• www.npmjs.com
• CWE-77
• OWASP 2021-A3

Related Issues

• appium-desktop OS Command Injection vulnerability - CVE-2023-2479
• Command Injection in cocos-utils - Vulnerability
• Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID) - CVE-2024-56334
• systeminformation has a Command Injection vulnerability in fsSize() function on Windows - CVE-2025-68154

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

dot