What’s Vulnerable › Vulnerabilities

CVE-2020-8116: dot-prop Prototype Pollution vulnerability

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-04 · updated 2026-06-17
• Weakness: CWE-471

Description

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Affected products

• dot-prop: before 4.2.1; from 5.0.0 before 5.1.1 — fixed in 4.2.1, 5.1.1
• Npm Dot-Prop: before 4.2.1; from 5.0.0 before 5.1.1 — fixed in 4.2.1, 5.1.1

How to fix

Upgrade to a fixed version: dot-prop 4.2.1, 5.1.1; Npm Dot-Prop 4.2.1, 5.1.1. Check the vendor advisory for mitigations.

References

• https://github.com/advisories/GHSA-ff7x-qrg7-qggm
• https://github.com/sindresorhus/dot-prop/issues/63
• https://github.com/sindresorhus/dot-prop/tree/v4
• https://hackerone.com/reports/719856
• https://github.com/advisories/GHSA-ff7x-qrg7-qggm
• https://github.com/sindresorhus/dot-prop/issues/63
• https://github.com/sindresorhus/dot-prop/tree/v4
• https://hackerone.com/reports/719856

Get alerted when CVE-2020-8116 or the next vulnerability affects your stack