Prototype Pollution in dotty

严重 9.8CVE-2021-23624 · GHSA-6g47-63mv-qpgh · SNYK-JS-DOTTY-1577292 · Published 03/11/2021 · updated 17/06/2026

要点

CVE-2021-23624 是影响 dotty (dotty project), dotty 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.3%，高于 70.3% 的漏洞。
修复：升级到 0.1.2 或更高版本。

Package	Affected versions	Patched versions
dotty dotty_project	`< 0.1.2`	`0.1.2`
dotty npm	`< 0.1.2`	`0.1.2`

Description

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

NVD description

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

References

nvd.nist.gov/vuln/detail/CVE-2021-23624 · ADVISORY
deoxxa/dotty commit 88f6186 · WEB
deoxxa/dotty · PACKAGE
snyk.io/vuln/SNYK-JS-DOTTY-1577292 · WEB

dotty 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free