Description
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.
Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
Recommendation
Update the dojo package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.16.0, < 1.16.2 >= 1.15.0, < 1.15.3 >= 1.14.0, < 1.14.6 >= 1.13.0, < 1.13.7 >= 1.12.0, < 1.12.8 < 1.11.10** Patched version(s): **1.16.2 1.15.3 1.14.6 1.13.7 1.12.8 1.11.10**
References
Could your website be exposed too?
SmartScanner can check your website for Prototype pollution in dojo - dojo and gives you actionable findings to investigate.
Start a free scanRelated Issues
- keyget vulnerable to prototype pollution - CVE-2020-28272
- flat vulnerable to Prototype Pollution - CVE-2020-36632
- shvl vulnerable to prototype pollution - CVE-2020-28278
- dset vulnerable to prototype pollution - CVE-2020-28277
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023