CVE-2020-5258: Prototype pollution in dojo
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.12.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.13.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.15.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.16.2
Event History
Frequently Asked Questions
What is CVE-2020-5258?
CVE-2020-5258 is a vulnerability in the Node.js handlebars module that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2020-5258?
CVE-2020-5258 has a severity rating of high.
How does CVE-2020-5258 work?
CVE-2020-5258 is caused by a prototype pollution flaw in the template of the handlebars module, allowing an attacker to add or modify properties of Object.prototype using a __proto__ or constructor payload.
Which software is affected by CVE-2020-5258?
IBM Security Verify Governance version 10.0 is affected by CVE-2020-5258.
How can CVE-2020-5258 be exploited?
An attacker can exploit CVE-2020-5258 by using a __proto__ or constructor payload to add or modify properties of Object.prototype in the handlebars module template, allowing them to execute arbitrary code.