CVEvulnerability

CVE-2020-8141

8.8 HIGH Published 2020-03-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-94

Description

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Affected configurations

• dot project dot 1.1.2

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References