PT-2020-19977 · Node.Js · Dot

Published 2020-03-15 · Updated 2022-05-24 · CVE-2020-8141

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dot package version 1.1.2

Description The issue concerns the dot package's use of Function() to compile templates, which can be exploited if an attacker can control the given template or the value set on Object.prototype.

Recommendations For dot package version 1.1.2, consider avoiding the use of user-controlled data in templates to minimize the risk of exploitation. As a temporary workaround, restrict the ability to set values on Object.prototype until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-8141

GHSA-297X-8XJ4-VCXV

Affected Products

Dot

References · 6

• 🔥 https://hackerone.com/reports/390929 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8141 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8141 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-297x-8xj4-vcxv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8141 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8141 · Vendor Advisory