VULNERABILITY INTELLIGENCE

CVE-2020-8116

CVSS score7.3 HIGH
EPSS probability3.08%
CISA KEVNot currently listed
Published2020-02-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Weakness classification

  • CWE-471: Modification of Assumed-Immutable Data (MAID)
  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Primary references