CVE-2020-5259: Prototype Pollution in Dojox
Summary
CVE-2020-5259: Prototype Pollution in Dojox. Affects dojox across 6 version ranges.
< 1.11.10
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.6
>= 1.15.0, < 1.15.3
>= 1.16.0, < 1.16.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- dojo · Debian:11
The same CVE-2020-5259 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dojox is an open-source JavaScript toolkit that provides a wide range of utilities and widgets for web development. It includes a jQuery wrapper called jqMix, which allows developers to use jQuery syntax with Dojox. This vulnerability affects the jqMix mixin method in Dojox, making it susceptible to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. In the case of Dojox's jqMix mixin method, the vulnerability arises from the improper handling of properties during the copying process. An attacker can exploit this vulnerability to modify or inject properties into the prototype chain, leading to unexpected behavior or security issues. The impact of this vulnerability can range from data manipulation to remote code execution.
How To Fix
Latest published version: 1.17.3 as of 23 Oct 2026
npm install dojox@1.17.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.101.11.10npm install dojox@1.11.10 -
>= 1.12.0, < 1.12.81.12.8npm install dojox@1.12.8 -
>= 1.13.0, < 1.13.71.13.7npm install dojox@1.13.7 -
>= 1.14.0, < 1.14.61.14.6npm install dojox@1.14.6 -
>= 1.15.0, < 1.15.31.15.3npm install dojox@1.15.3 -
>= 1.16.0, < 1.16.21.16.2npm install dojox@1.16.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Dojox package is not immediately feasible, a possible workaround is to avoid using the vulnerable jqMix mixin method. Developers can opt for alternative methods or libraries to achieve the desired functionality without exposing their application to the Prototype Pollution vulnerability.
Conclusion
The Prototype Pollution vulnerability in Dojox's jqMix mixin method can have serious consequences, including data manipulation and remote code execution. It is crucial to update the Dojox package to the latest version or apply alternative solutions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dojox →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior or security issues.
The vulnerability in the jqMix mixin method arises from the improper handling of properties during the copying process, allowing an attacker to modify or inject properties into the prototype chain.
The impact of this vulnerability can range from data manipulation to remote code execution, depending on how it is exploited by an attacker.
To fix this vulnerability, update the Dojox package to version 1.11.10 or higher, which includes a fix for the Prototype Pollution issue in the jqMix mixin method.
If updating the Dojox package is not immediately feasible, developers can avoid using the vulnerable jqMix mixin method and explore alternative methods or libraries to achieve the desired functionality.
References
Related vulnerabilities
Recent vulnerabilities recorded for dojox.
