CVE-2020-8116 dot-prop Prototype Pollution vulnerability
Prototype pollution in dot-prop allows attackers to modify JavaScript object prototypes, potentially leading to code execution or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8116?
CVE-2020-8116 is a high-severity vulnerability in dot-prop, published on 4 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Which versions are affected by CVE-2020-8116?
4 open source packages ship an affected version, including dot-prop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dot-prop npm | All versions | 4.2.1 |
dot-prop npm | All versions | 4.2.1 |
dot-prop npm | From 5.0.0 | 5.1.1 |
dot-prop npm | From 5.0.0 | 5.1.1 |
Products include Dot-Prop Project Dot-Prop.
How do I fix CVE-2020-8116?
Upgrade dot-prop to a fixed version for your release line: 4.2.1 or 5.1.1.
Is CVE-2020-8116 being exploited?
There is no known exploitation of CVE-2020-8116 in the wild and no public exploit code.
Sources
Also known as AZL-45084, DEBIAN-CVE-2020-8116, GHSA-ff7x-qrg7-qggm, ROOT-APP-NPM-CVE-2020-8116, UBUNTU-CVE-2020-8116.