VULNERABILITY INTELLIGENCE

CVE-2020-8141

CVSS score8.8 HIGH

EPSS probability2.20%

CISA KEVNot currently listed

Published2020-03-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Weakness classification

support@hackerone.com: CWE-94
nvd@nist.gov: CWE-94

Primary references

support@hackerone.com — Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory