--- id: CVE-2020-5258 title: >- In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution summary: >- In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.… severity: high cvss: 7.7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N' cwe: - CWE-94 - CWE-1321 vendor: linuxfoundation product: dojo affected: - dojo < 1.11.10 - 'dojo >= 1.12.0, < 1.12.8' - 'dojo >= 1.13.0, < 1.13.7' - 'dojo >= 1.14.0, < 1.14.6' - 'dojo >= 1.15.0, < 1.15.3' - 'dojo >= 1.16.0, < 1.16.2' - debian_linux = 8.0 - communications_application_session_controller = 3.9.0 - communications_policy_management = 12.5.0 - communications_pricing_design_center = 12.0.0.3.0 - 'documaker >= 12.6.0, <= 12.6.4' - 'mysql >= 7.3.0, <= 7.3.29' - 'mysql >= 7.4.0, <= 7.4.28' - 'mysql >= 7.5.0, <= 7.5.18' - 'mysql >= 7.6.0, <= 7.6.14' - 'mysql >= 8.0.0, <= 8.0.20' - 'primavera_unifier >= 17.7, <= 17.12' - primavera_unifier = 18.8 - primavera_unifier = 19.12 - primavera_unifier = 20.12 - webcenter_sites = 12.2.1.3.0 - webcenter_sites = 12.2.1.4.0 - weblogic_server = 12.2.1.4.0 - weblogic_server = 14.1.1.0.0 patched: - dojo 1.16.2 published: '2020-03-10' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:17:00.517' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-5258' references: - url: >- https://github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d label: security-advisories@github.com - url: 'https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2' label: security-advisories@github.com - url: >- https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b%40%3Cusers.qpid.apache.org%3E label: security-advisories@github.com - url: >- https://lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6df326fd3%40%3Cusers.qpid.apache.org%3E label: security-advisories@github.com - url: >- https://lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a806554d00%40%3Cusers.qpid.apache.org%3E label: security-advisories@github.com - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html' label: security-advisories@github.com - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: security-advisories@github.com - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: security-advisories@github.com - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: security-advisories@github.com - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: security-advisories@github.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: security-advisories@github.com - url: >- https://github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b%40%3Cusers.qpid.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6df326fd3%40%3Cusers.qpid.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a806554d00%40%3Cusers.qpid.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.04023 epssPercentile: 0.90321 ingestedAt: '2026-10-08T23:16:47.303Z' --- ## Overview In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2 ## Affected - `dojo < 1.11.10` - `dojo >= 1.12.0, < 1.12.8` - `dojo >= 1.13.0, < 1.13.7` - `dojo >= 1.14.0, < 1.14.6` - `dojo >= 1.15.0, < 1.15.3` - `dojo >= 1.16.0, < 1.16.2` - `debian_linux = 8.0` - `communications_application_session_controller = 3.9.0` - `communications_policy_management = 12.5.0` - `communications_pricing_design_center = 12.0.0.3.0` - `documaker >= 12.6.0, <= 12.6.4` - `mysql >= 7.3.0, <= 7.3.29` - `mysql >= 7.4.0, <= 7.4.28` - `mysql >= 7.5.0, <= 7.5.18` - `mysql >= 7.6.0, <= 7.6.14` - `mysql >= 8.0.0, <= 8.0.20` - `primavera_unifier >= 17.7, <= 17.12` - `primavera_unifier = 18.8` - `primavera_unifier = 19.12` - `primavera_unifier = 20.12` - `webcenter_sites = 12.2.1.3.0` - `webcenter_sites = 12.2.1.4.0` - `weblogic_server = 12.2.1.4.0` - `weblogic_server = 14.1.1.0.0` ## Remediation Upgrade past the affected range: - `dojo 1.16.2`