CVE-2020-5258

In affected versions of dojo (NPM package), the deepCopy method is
vulnerable to Prototype Pollution. Prototype Pollution refers to the
ability to inject properties into existing JavaScript language construct
prototypes, such as objects. An attacker manipulates these attributes to
overwrite, or pollute, a JavaScript application object prototype of the
base object by injecting other values. This has been patched in versions
1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953585&gt;