-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from prototype pollution affecting templateSettings.varname used in doT.template's Function() constructor. The patch fixes the initialization of settings in InstallDots, but the exploit occurs when doT.template uses a polluted varname. The test case demonstrates code execution via prototype pollution, which would trigger during template compilation in doT.template.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dot | npm | <= 1.1.2 | 1.1.3 |