dot-prop Prototype Pollution vulnerability

Description

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Recommendation

Update the dot-prop package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.1.1

  < 4.2.1**

• Patched version(s): **5.1.1

  4.2.1**

References

• GHSA-ff7x-qrg7-qggm
• hackerone.com
• CVE-2020-8116
• CWE-1321
• CWE-425
• CWE-471
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• eivindfjeldstad-dot contains prototype pollution vulnerability - CVE-2020-7639
• Prototype pollution vulnerability in 'libnested - CVE-2020-28283
• Prototype pollution vulnerability in 'deepref - CVE-2020-28274
• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

dot-prop