Cross-site scripting in dojox
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.
Why it matters now
EPSS 0.01845 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial dojox (npm): 1.11.9, 1.12.7, 1.13.6 +3Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dojox | all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. | — | No fix listed | CNA |
| — | dojox (npm) | before 1.11.9 | 1.11.9 | Patch available | GHSA-pg97-ww7h-5mjr |
| — | dojox (npm) | 1.12.0 to before 1.12.7 | 1.12.7 | Patch available | GHSA-pg97-ww7h-5mjr |
| — | dojox (npm) | 1.13.0 to before 1.13.6 | 1.13.6 | Patch available | GHSA-pg97-ww7h-5mjr |
| — | dojox (npm) | 1.14.0 to before 1.14.5 | 1.14.5 | Patch available | GHSA-pg97-ww7h-5mjr |
| — | dojox (npm) | 1.15.0 to before 1.15.2 | 1.15.2 | Patch available | GHSA-pg97-ww7h-5mjr |
| — | dojox (npm) | 1.16.0 to before 1.16.1 | 1.16.1 | Patch available | GHSA-pg97-ww7h-5mjr |
- dojox Vendor— Affected all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. Fixed in — No fix listed CNA
- dojox (npm) Vendor— Affected before 1.11.9 Fixed in 1.11.9 Patch available GHSA-pg97-ww7h-5mjr
- dojox (npm) Vendor— Affected 1.12.0 to before 1.12.7 Fixed in 1.12.7 Patch available GHSA-pg97-ww7h-5mjr
- dojox (npm) Vendor— Affected 1.13.0 to before 1.13.6 Fixed in 1.13.6 Patch available GHSA-pg97-ww7h-5mjr
- dojox (npm) Vendor— Affected 1.14.0 to before 1.14.5 Fixed in 1.14.5 Patch available GHSA-pg97-ww7h-5mjr
- dojox (npm) Vendor— Affected 1.15.0 to before 1.15.2 Fixed in 1.15.2 Patch available GHSA-pg97-ww7h-5mjr
- dojox (npm) Vendor— Affected 1.16.0 to before 1.16.1 Fixed in 1.16.1 Patch available GHSA-pg97-ww7h-5mjr
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:dojox:*:*:*:*:*:node.js:*:* | 1.11.0 to before 1.11.9; 1.12.0 to before 1.12.7; 1.13.0 to before 1.13.6; 1.14.0 to before 1.14.5; 1.15.0 to before 1.15.2; 1.16.0 to before 1.16.1 | Vulnerable | backstage |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
- cpe:2.3:a:linuxfoundation:dojox:*:*:*:*:*:node.js:*:* Versions 1.11.0 to before 1.11.9; 1.12.0 to before 1.12.7; 1.13.0 to before 1.13.6; 1.14.0 to before 1.14.5; 1.15.0 to before 1.15.2; 1.16.0 to before 1.16.1 Vulnerable ·backstage
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-pg97-ww7h-5mjr dojox (npm) Fixed in 1.11.9 Advisory →
- Fix · GHSA-pg97-ww7h-5mjr dojox (npm) Fixed in 1.12.7 Advisory →
- Fix · GHSA-pg97-ww7h-5mjr dojox (npm) Fixed in 1.13.6 Advisory →
- Fix · GHSA-pg97-ww7h-5mjr dojox (npm) Fixed in 1.14.5 Advisory →
- Fix · GHSA-pg97-ww7h-5mjr dojox (npm) Fixed in 1.15.2 Advisory →
- Fix · GHSA-pg97-ww7h-5mjr dojox (npm) Fixed in 1.16.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 5 | Affected | No fix planned: Out of support scope |
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10785
- 2026-10-03 Alias added: GHSA-pg97-ww7h-5mjr
References
Advisory 2
Sources
- CVE-2019-10785 · CVE Program
- CVE-2019-10785 · NVD
- FIRST EPSS
- GHSA-pg97-ww7h-5mjr · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10785 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences