| Name | CVE-2020-8116 |
| Description | Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| node-dot-prop (PTS) | buster | 4.1.1-1+deb10u2 | fixed |
| bullseye | 6.0.1-1 | fixed |
| sid, trixie, bookworm | 7.2.0-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| node-dot-prop | source | buster | 4.1.1-1+deb10u1 | | | |
| node-dot-prop | source | (unstable) | 5.2.0-1 | | | |
Notes
https://hackerone.com/reports/719856
https://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2