Information disclosure

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function...

CVE-2020-7717 Prototype Pollution

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function...

Prototype Pollution

Overview dot-notes is a Two way conversions between objects and dot/bracket notation Affected versions of this package are vulnerable to Prototype Pollution via the create function. POC: const dots = require'dot-notes'; dots.create, 'proto.polluted', true; console.logpolluted; Details Prototype...