CVE-2020-5258: Prototype pollution in dojo
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-5258?
CVE-2020-5258 is a vulnerability in the Node.js handlebars module that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2020-5258?
CVE-2020-5258 has a severity rating of high.
How does CVE-2020-5258 work?
CVE-2020-5258 is caused by a prototype pollution flaw in the template of the handlebars module, allowing an attacker to add or modify properties of Object.prototype using a __proto__ or constructor payload.
Which software is affected by CVE-2020-5258?
IBM Security Verify Governance version 10.0 is affected by CVE-2020-5258.
How can CVE-2020-5258 be exploited?
An attacker can exploit CVE-2020-5258 by using a __proto__ or constructor payload to add or modify properties of Object.prototype in the handlebars module template, allowing them to execute arbitrary code.