Prototype pollution in dojo

Summary

CVE	CVE-2020-5258
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-03-10 18:15:12 UTC
Updated	2026-10-08 22:17:00 UTC
Description	In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Problem Types: CWE-94 | CWE-1321 | CWE-94 CWE-94: Improper Control of Generation of Code ('Code Injection')

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
3.1	[email protected]	Secondary	7.7	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`
3.1	CNA	DECLARED	7.7	HIGH	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`
2.0	[email protected]	Primary	5		`AV:N/AC:L/Au:N/C:N/I:P/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Type	Vendor	Product	Version	Update	Edition	Language
Application	Linuxfoundation	Dojo	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Dojo	Dojo	affected < 1.12.8	Not specified
CNA	Dojo	Dojo	affected >= 1.13.0, < 1.13.7	Not specified
CNA	Dojo	Dojo	affected >= 1.14.0, < 1.14.6	Not specified
CNA	Dojo	Dojo	affected >= 1.15.0, < 1.15.3	Not specified
CNA	Dojo	Dojo	affected >= 1.16.0, < 1.16.2	Not specified

Reference	Source	Link	Tags
Pony Mail!	af854a3a-2127-422b-91ae-364da2661108	lists.apache.org
Oracle Critical Patch Update Advisory - October 2021	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
Oracle Critical Patch Update Advisory - July 2021	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
Merge pull request from GHSA-jxfh-8wgv-vfr2 · dojo/dojo@20a00af · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Patch, Third Party Advisory
Pony Mail!	af854a3a-2127-422b-91ae-364da2661108	lists.apache.org
[SECURITY] [DLA 2139-1] dojo security update	af854a3a-2127-422b-91ae-364da2661108	lists.debian.org	Mailing List, Third Party Advisory
Oracle Critical Patch Update Advisory - January 2022	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
Oracle Critical Patch Update Advisory - July 2022	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com
Pony Mail!	af854a3a-2127-422b-91ae-364da2661108	lists.apache.org
Prototype pollution · Advisory · dojo/dojo · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Exploit, Third Party Advisory
Oracle Critical Patch Update Advisory - July 2020	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Third Party Advisory
Pony Mail!	MITRE	lists.apache.org
Pony Mail!	MITRE	lists.apache.org
Pony Mail!	MITRE	lists.apache.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

375703 IBM WebSphere Application Server Prototype Pollution Vulnerability (6443101)
980306 Nodejs (npm) Security Update for dojo (GHSA-jxfh-8wgv-vfr2)