---
title: "GHSA-ff7x-qrg7-qggm: dot-prop Prototype Pollution vulnerability"
description: "High severity. dot-prop Prototype Pollution vulnerability. Affects dot-prop; fixed in 5.1.1."
url: https://inlinr.com/advisories/GHSA-ff7x-qrg7-qggm
lang: en
---

[Packages](https://inlinr.com/packages) / [dot-prop](https://inlinr.com/packages/dot-prop) / [Security](https://inlinr.com/packages/dot-prop/security)

High Vulnerability GHSA-ff7x-qrg7-qggm CVE-2020-8116 Published 29 Jul 2020

# dot-prop Prototype Pollution vulnerability

Your version 

Affected releases · [dot-prop](https://inlinr.com/packages/dot-prop)

- 5.x 5.0.0 – 5.1.0 Fixed in 5.1.1
- 4.x 4.0.0 – 4.2.0 Fixed in 4.2.1
- 3.x and older 1.0.0 – 3.0.0 No fix, no longer updated

On 5.x, the newest line:

```
npm install dot-prop@5.1.1
```

Every release on a timeline

10.x 

1. Not affected

10.0.0 – 10.2.0  
3 releases, latest

5.x 

1. Affected

5.0.0 – 5.1.0  
3 releases
2. Fixed

5.1.1 – 5.3.0  
3 releases

4.x 

1. Affected

4.0.0 – 4.2.0  
4 releases
2. Fixed

4.2.1  
1 release

3.x 

1. Affected

3.0.0  
1 release

2.x 

1. Affected

2.0.0 – 2.4.0  
5 releases

1.x 

1. Affected

1.0.0 – 1.0.1  
2 releases

32 stable releases of dot-prop, oldest to newest, one row per major.

## What happens

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:L/​I:L/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8116 "https://nvd.nist.gov/vuln/detail/CVE-2020-8116")  
nvd.nist.gov/vuln/detail/CVE-2020-8116
- [Issue](https://github.com/sindresorhus/dot-prop/issues/63 "https://github.com/sindresorhus/dot-prop/issues/63")  
#63
- [Fix commit](https://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2 "https://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2")  
3039c8c
- [Fix commit](https://github.com/sindresorhus/dot-prop/commit/c914124f418f55edea27928e89c94d931babe587 "https://github.com/sindresorhus/dot-prop/commit/c914124f418f55edea27928e89c94d931babe587")  
c914124
- [Reference](https://hackerone.com/reports/719856 "https://hackerone.com/reports/719856")  
hackerone.com/reports/719856
- [GitHub advisory](https://github.com/advisories/GHSA-ff7x-qrg7-qggm "https://github.com/advisories/GHSA-ff7x-qrg7-qggm")  
github.com/advisories/GHSA-ff7x-qrg7-qggm
- [Package](https://github.com/sindresorhus/dot-prop "https://github.com/sindresorhus/dot-prop")  
github.com/sindresorhus/dot-prop
- [Reference](https://github.com/sindresorhus/dot-prop/tree/v4 "https://github.com/sindresorhus/dot-prop/tree/v4")  
github.com/sindresorhus/dot-prop/tree/v4