MEDIUM6.3

GHSA-j9cf-pr2x-5273

Prototype Pollution in dot-object

Quick fix

GHSA-j9cf-pr2x-5273 — dot-object: upgrade to the fixed version with the command below.

npm install dot-object@2.1.3

Details

dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/dot-object

Introduced in: 0Fixed in: 2.1.3

Fixnpm install dot-object@2.1.3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10793[ADVISORY]
https://github.com/rhalff/dot-object/commit/f76cff5fe6d01d30ce110d8f454db2e5bd28a7de[WEB]
https://github.com/rhalff/dot-object[PACKAGE]
https://snyk.io/vuln/SNYK-JS-DOTOBJECT-548905[WEB]