CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2020-8116
High (7.3) in dot-prop project dot-prop. EPSS 3.1% chance of exploitation in the next 30 days. Fixed in dot-prop 4.2.1, 5.1.1.
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Severity
- EPSS
- 3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-1321, CWE-471
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dot-prop_project:dot-prop
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ff7x-qrg7-qggm | npm | dot-prop | <4.2.1 | 4.2.1 |
| GHSA-ff7x-qrg7-qggm | npm | dot-prop | >=5.0.0 <5.1.1 | 5.1.1 |