CVE-2020-5258: Prototype Pollution in dojo
Summary
CVE-2020-5258: Prototype pollution in dojo. Affects dojo across 6 version ranges.
< 1.11.10
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.6
>= 1.15.0, < 1.15.3
>= 1.16.0, < 1.16.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- dojo · Debian:11
The same CVE-2020-5258 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dojo is an open-source JavaScript toolkit that provides a comprehensive set of features for building web applications. It offers a wide range of utilities, modules, and widgets to simplify the development process. However, versions of dojo prior to 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2 are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that allows an attacker to inject properties into existing JavaScript language construct prototypes, such as objects. In the case of dojo, the deepCopy method is susceptible to this issue. By manipulating certain attributes, an attacker can overwrite or pollute the JavaScript application object prototype of the base object with malicious values. This can lead to various security risks, including remote code execution, information disclosure, and denial of service.
How To Fix
Latest published version: 1.17.3 as of 23 Oct 2026
npm install dojo@1.17.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.101.11.10npm install dojo@1.11.10 -
>= 1.12.0, < 1.12.81.12.8npm install dojo@1.12.8 -
>= 1.13.0, < 1.13.71.13.7npm install dojo@1.13.7 -
>= 1.14.0, < 1.14.61.14.6npm install dojo@1.14.6 -
>= 1.15.0, < 1.15.31.15.3npm install dojo@1.15.3 -
>= 1.16.0, < 1.16.21.16.2npm install dojo@1.16.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to a patched version is not immediately feasible, a temporary workaround is to avoid using the deepCopy method in dojo. By refraining from utilizing this specific functionality, the risk of exploitation can be reduced. However, it is strongly advised to update to the latest patched version as soon as possible.
Conclusion
Prototype Pollution in dojo (CVE-2020-5258) is a critical vulnerability that can lead to various security risks. It is crucial to update dojo to versions 1.12.8, 1.13.7, 1.14.6, 1.15.3, or 1.16.2 to mitigate this issue. If immediate updating is not possible, avoiding the deepCopy method can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dojo →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to inject properties into existing JavaScript language construct prototypes, potentially leading to security risks.
The impact of this vulnerability can vary depending on the specific usage of dojo in an application. However, it can potentially result in remote code execution, information disclosure, or denial of service.
Versions of dojo prior to 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2 are vulnerable to Prototype Pollution.
To fix this vulnerability, update dojo to versions 1.12.8, 1.13.7, 1.14.6, 1.15.3, or 1.16.2. Alternatively, avoid using the deepCopy method until the package can be updated.
A temporary workaround is to refrain from using the deepCopy method in dojo. However, it is recommended to update to a patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for dojo.
