Prototype Pollution in Dojox

Also known as GHSA-3hw5-q855-g6cw

Published 6 y ago 2020-03-10 · modified 4 mo ago 2026-07-08 · JSON

CVSS

7.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.0%

percentile 81%

Public exploits

none known

In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Exploit prediction (EPSS)

2.02% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	7.7	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`
CNA	3.1	7.7	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`
NVD	3.1	8.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:P/A:N`
GitHub	3.1	7.7	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`dojox`	<1.11.10 >=1.12.0, <1.12.8 >=1.13.0, <1.13.7 >=1.14.0, <1.14.6 >=1.15.0, <1.15.3 >=1.16.0, <1.16.2	1.11.10 1.12.8 1.13.7 1.14.6 1.15.3 1.16.2

Affected products

dojo dojox

Classification

Weakness

CWE-94 Improper Control of Generation of Code
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

github.com /dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw · x_refsource_CONFIRM, x_transferred
github.com /dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da · x_refsource_MISC, x_transferred
lists.debian.org /debian-lts-announce/2020/03/msg00012.html · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2020-5259 · advisory

Sources

CVE List: CVE-2020-5259
GitHub Advisory: GHSA-3hw5-q855-g6cw
NVD: CVE-2020-5259

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary