GitHub Advisoryadvisory · npm

GHSA-297x-8xj4-vcxv Improper Control of Generation of Code in doT

HIGH Published 2022-05-24 Modified 2022-06-23 Official page ↗
Aliases
CVE-2020-8141
Ecosystem
npm
Packages
dot
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-06-23

Affected packages

• npm dot: < 1.1.3 → fixed in 1.1.3

Description

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Related

Alias · CVE (1)

  • CVE-2020-8141 The dot package v1.1.2 uses Function() to compile templates. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References