eivindfjeldstad-dot contains prototype pollution vulnerability

Description

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function ‘set’ could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload.

Recommendation

Update the @eivifj/dot package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.3
• Patched version(s): 1.0.3

References

• GHSA-wfwq-xc57-fq7v
• snyk.io
• CVE-2020-7639
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• dot-prop Prototype Pollution vulnerability - CVE-2020-8116
• Prototype pollution vulnerability in 'deepref - CVE-2020-28274
• Prototype pollution vulnerability in 'libnested - CVE-2020-28283
• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@eivifj/dot