Unrated
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they c...
CVE-2020-8141
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2020-8141 node-dot Fixed in: 1.1.3+ds-1
Original description The description as published by the source.
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- report hackerone.com