CVE-2020-8116: dot-prop Prototype Pollution vulnerability
Summary
CVE-2020-8116: dot-prop Prototype Pollution vulnerability. Affects dot-prop across 2 version ranges.
< 4.2.1
>= 5.0.0, < 5.1.1
Fixed in 4.2.1 or 5.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- node-dot-prop · Debian:11
The same CVE-2020-8116 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dot-prop is an npm package that provides utility functions for working with nested properties in JavaScript objects. It allows developers to access and manipulate nested properties using dot notation. The package is widely used in JavaScript projects and is part of the npm ecosystem.
Vulnerability Detail
The dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 are vulnerable to Prototype Pollution. This vulnerability allows an attacker to add arbitrary properties to JavaScript language constructs such as objects. By manipulating the prototype chain, an attacker can modify or add properties to objects, potentially leading to unauthorized access, data tampering, or remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.2.14.2.1npm install dot-prop@4.2.1 -
>= 5.0.0, < 5.1.15.1.1npm install dot-prop@5.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the dot-prop package to the latest version as soon as possible.
Conclusion
The dot-prop Prototype Pollution vulnerability is a high-severity issue that allows an attacker to add arbitrary properties to JavaScript objects. To mitigate this vulnerability, it is crucial to update the dot-prop package to the latest version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for dot-prop →
FAQ
dot-prop is an npm package that provides utility functions for working with nested properties in JavaScript objects. It allows developers to access and manipulate nested properties using dot notation.
Prototype Pollution is a vulnerability that allows an attacker to modify or add properties to JavaScript objects by manipulating the prototype chain. This can lead to unauthorized access, data tampering, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using package-lock.json.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-ff7x-qrg7-qggm/GHSA-ff7x-qrg7-qggm.json
