Command Injection in dot

MEDIUMGHSA-4859-gpc7-4j66 · Published 05/06/2019 · updated 04/08/2021

In short

GHSA-4859-gpc7-4j66 is a MEDIUM vulnerability affecting dot.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dot npm	`≤ 1.1.2`	No fix yet

Description

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.

References

hackerone.com/reports/390929 · WEB
npmjs.com/advisories/798 · WEB

More vulnerabilities in dot

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free