Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2019-10793: dot-object 2.1.3 and earlier allows attackers to alter JavaScript behavior
CVE-2019-10793 · published 6 years ago
Summary
A security issue in dot-object before 2.1.3 could allow an attacker to modify certain JavaScript behavior. This could happen if you're using an older version of dot-object and interact with user-supplied data. Update to dot-object 2.1.3 or later to fix this issue.
What to do
- Update rhalff dot-object to version 2.1.3.
- Update dot-object_project dot-object to version 2.1.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | rhalff | dot-object |
< 2.1.3 Fix: upgrade to 2.1.3
|
| – | dot-object_project | dot-object |
< 2.1.3 cpe:2.3:a:dot-object_project:dot-object:*:*:*:*:*:node.js:*:* |
Original advisory text
Prototype Pollution in dot-object
dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10793
- https://github.com/advisories/GHSA-j9cf-pr2x-5273
- https://github.com/rhalff/dot-object Product
- https://github.com/rhalff/dot-object/commit/f76cff5fe6d01d30ce110d8f454db2e5bd28... Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-DOTOBJECT-548905 Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-74Injection
Timeline
Published18 Feb 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta