Read the docs

Dot Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Dot Project records in CISA KEV

No Dot Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dot 2 records MEDIUM

Records

2 records in Dot · all components

TI-2020-06559 CVE-2020-8141 · GHSA-297x-8xj4-vcxv

Code injection in dot

Priority MEDIUM 42

The dot package v1.1.2 uses Function() to compile templates.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02197 Published 2020-03-15 Fixed in 1.1.3 CWE-94
TI-2020-06160 CVE-2020-7639 · GHSA-wfwq-xc57-fq7v

Prototype pollution in @eivifj/dot

Priority LOW 32

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01097 Published 2020-04-06 Fixed in 1.0.3 CWE-1321
Open these records in search →