dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a proto payload.
References:MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWo5Y2YtcHIyeC01Mjcz
Prototype Pollution in dot-object
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| npm:dot-object | < 2.1.3 | 2.1.3 | |
Affected Version RangesAll affected versions0.3.0, 0.4.0, 0.4.1, 0.5.0, 0.6.0, 0.7.0, 0.8.0, 0.8.1, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.11.0, 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.8.1, 1.9.0, 2.0.0, 2.1.0, 2.1.1, 2.1.2 All unaffected versions2.1.3, 2.1.4, 2.1.5 |
|||