Description
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.
Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
Recommendation
Update the dojo package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.16.0, < 1.16.2 >= 1.15.0, < 1.15.3 >= 1.14.0, < 1.14.6 >= 1.13.0, < 1.13.7 >= 1.12.0, < 1.12.8 < 1.11.10** Patched version(s): **1.16.2 1.15.3 1.14.6 1.13.7 1.12.8 1.11.10**
References
- GHSA-jxfh-8wgv-vfr2
- lists.debian.org
- www.oracle.com
- lists.apache.org
- CVE-2020-5258
- CWE-1321
- CWE-74
- CWE-94
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- keyget vulnerable to prototype pollution - CVE-2020-28272
- flat vulnerable to Prototype Pollution - CVE-2020-36632
- shvl vulnerable to prototype pollution - CVE-2020-28278
- dset vulnerable to prototype pollution - CVE-2020-28277
You might also like:
- Tags:
- npm
- dojo
Anything's wrong? Let us know Last updated on January 27, 2023


