VULNERABILITY INTELLIGENCE
CVE-2020-5258
CVSS score7.7 HIGH
EPSS probability4.02%
CISA KEVNot currently listed
Published2020-03-10
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Description
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Weakness classification
- security-advisories@github.com: CWE-94
- nvd@nist.gov: CWE-1321
Primary references
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Exploit, Third Party Advisory
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com — Mailing List, Third Party Advisory
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Third Party Advisory
- security-advisories@github.com
- security-advisories@github.com — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory