CVE-2020-28458: Prototype Pollution in datatables.net
Summary
CVE-2020-28458: datatables.net vulnerable to Prototype Pollution due to incomplete fix. Affects datatables.net versions < 1.10.22. Fixed in 1.10.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
datatables.net is an npm package that provides advanced interaction controls for HTML tables. It allows developers to enhance the functionality and user experience of tables on web pages. However, all versions of datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for a previously reported vulnerability. Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
Vulnerability Detail
The vulnerability in datatables.net arises from a failure to fully address the issue of Prototype Pollution. This vulnerability can be exploited by an attacker to modify the behavior of the affected application by injecting malicious properties into the prototype of objects. This can lead to various security risks, such as remote code execution, information disclosure, or denial of service attacks. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.3.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install datatables.net@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.22
This is the first release that contains the fix.
npm install datatables.net@1.10.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the latest version to ensure the security of the application.
Conclusion
datatables.net is vulnerable to Prototype Pollution due to an incomplete fix. This vulnerability can be mitigated by updating the package to version 1.10.22 or later. It is crucial to stay updated with the latest security patches and follow best practices to ensure the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for datatables.net →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues. It can be exploited to inject malicious properties into the prototype, which can result in various attacks.
The potential risks of this vulnerability include remote code execution, information disclosure, or denial of service attacks. An attacker can modify the behavior of the affected application by injecting malicious properties into the prototype of objects.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, a fix is available for this vulnerability. It is recommended to update the datatables.net package to version 1.10.22 or later to mitigate the vulnerability.
There are no known workarounds for this vulnerability. It is essential to update the package to the latest version to ensure the security of the application.
Related vulnerabilities
Recent vulnerabilities recorded for datatables.net.
