CVE-2020-8141 Improper Control of Generation of Code in doT
Attackers can execute arbitrary code by controlling templates or Object.prototype in the dot JavaScript library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8141?
CVE-2020-8141 is a high-severity code injection vulnerability in dot, published on 15 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Weakness: CWE-94
Which versions are affected by CVE-2020-8141?
2 open source packages ship an affected version, including dot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dot npm | All versions | 1.1.3 |
dot npm | All versions | 1.1.3 |
Products include Dot Project Dot.
How do I fix CVE-2020-8141?
Upgrade dot to 1.1.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-8141 being exploited?
There is no known exploitation of CVE-2020-8141 in the wild and no public exploit code.
Other vulnerabilities in dot
Sources
Also known as CLSA-2026-1792424782, DEBIAN-CVE-2020-8141, GHSA-297x-8xj4-vcxv.