CVE-2020-8141: Code Injection
Node.js dot package could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Function(). By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-8141?
CVE-2020-8141 is a vulnerability in the dot package v1.1.2 of Node.js that allows a remote attacker to execute arbitrary code on the system.
How does the CVE-2020-8141 vulnerability work?
The vulnerability in dot package v1.1.2 is caused by a flaw in the Function() function, which can be exploited by an attacker sending a specially crafted request to execute arbitrary code on the system.
What is the severity of CVE-2020-8141?
The severity of CVE-2020-8141 is critical with a severity value of 9.8.
Which software versions are affected by CVE-2020-8141?
The affected software version is dot package v1.1.2 of Node.js.
How can I fix the CVE-2020-8141 vulnerability?
To fix the CVE-2020-8141 vulnerability, update the dot package of Node.js to a version that does not have this vulnerability.