CVE-2020-8141: dot - Improper Control of Generation of Code in doT
Summary
CVE-2020-8141: Improper Control of Generation of Code in doT. Affects dot versions < 1.1.3. Fixed in 1.1.3. How to fix ↓
Also tracked for
- node-dot · Debian:11
The same CVE-2020-8141 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dot package is an npm package that provides a templating engine called doT. It is used to compile templates by using the Function() method. However, in version 1.1.2 of the dot package, there is an improper control of the generation of code, which can be exploited by an attacker. This vulnerability can be triggered if the attacker can control the template or the value set on Object.prototype.
Vulnerability Detail
The vulnerability in the dot package allows an attacker to execute arbitrary code by controlling the template or the value set on Object.prototype. By exploiting this vulnerability, an attacker can potentially execute malicious code on the target system, leading to various consequences such as remote code execution, information disclosure, or denial of service.
How To Fix
Minimum fixed version
1.1.3
This is the first release that contains the fix.
npm install dot@1.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the dot package to the latest version as soon as possible.
Conclusion
In conclusion, the dot package version 1.1.2 is vulnerable to an improper control of code generation in doT. This vulnerability can be exploited by an attacker to execute arbitrary code on the target system. To mitigate this vulnerability, it is recommended to update the dot package to version 1.1.3 or later. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dot →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to remote code execution, information disclosure, or denial of service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is available in version 1.1.3 of the dot package. It is recommended to update to this version or later to mitigate the vulnerability.
No, there are no known workarounds for this vulnerability. It is recommended to update the dot package to the latest version.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-297x-8xj4-vcxv/GHSA-297x-8xj4-vcxv.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for dot.
