Packages / dot-prop / Security

HighVulnerabilityGHSA-ff7x-qrg7-qggmCVE-2020-8116Published 29 Jul 2020

dot-prop Prototype Pollution vulnerability

Your version

Affected releases · dot-prop

  • 5.x5.0.0 – 5.1.0Fixed in 5.1.1
  • 4.x4.0.0 – 4.2.0Fixed in 4.2.1
  • 3.x and older1.0.0 – 3.0.0No fix, no longer updated

On 5.x, the newest line:

npm install dot-prop@5.1.1
Every release on a timeline
10.x

  1. Not affected

    10.0.0 – 10.2.0

    3 releases, latest

5.x

  1. Affected

    5.0.0 – 5.1.0

    3 releases

  2. Fixed

    5.1.1 – 5.3.0

    3 releases

4.x

  1. Affected

    4.0.0 – 4.2.0

    4 releases

  2. Fixed

    4.2.1

    1 release

3.x

  1. Affected

    3.0.0

    1 release

2.x

  1. Affected

    2.0.0 – 2.4.0

    5 releases

1.x

  1. Affected

    1.0.0 – 1.0.1

    2 releases

32 stable releases of dot-prop, oldest to newest, one row per major.

What happens

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.