VDB
Sign up
HIGH8.8

GHSA-297x-8xj4-vcxv

Improper Control of Generation of Code in doT

Quick fix

GHSA-297x-8xj4-vcxv — dot: upgrade to the fixed version with the command below.

npm install dot@1.1.3

Details

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/dot
Introduced in: 0Fixed in: 1.1.3
Fixnpm install dot@1.1.3

References