CVE-2020-8141

CVE-2020-8141 affects the dot package (v1.1.2). The vulnerability stems from using Function() to compile templates, which can be abused if an attacker can control the template or the value on Object.prototype. The connected advisories (GitHub GHSA-297X-8XJ4-VCXV and OSV/NVD entries) describe the ...

CVE-2020-7639

Summary: CVE-2020-7639 affects the eivindfjeldstad-dot package prior to 1.0.3. The vulnerability is a Prototype Pollution flaw in the package’s set function, which can be triggered with a proto payload to add or modify properties on Object.prototype. The Red Hat, GHSA, OSV, CNVD, CVE, CVELIST ent...