CVE-2018-15494
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
CVE-2018-15494- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-116
- Updated
- 2026-11-02
CVE List No score
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
CVE-2018-15494- Updated
- 2026-11-02
EUVDEUVD-2018-0543 No score
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
EUVD-2018-0543- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-84cm-x2q5-8225
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
GHSA-84cm-x2q5-8225- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
CVE-2018-15494- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
DEBIAN-CVE-2018-15494- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-84cm-x2q5-8225
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
GHSA-84cm-x2q5-8225- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
- Record
UBUNTU-CVE-2018-15494- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-7569-1 No score
dojo vulnerabilities
It was discovered that Dojo did not correctly handle DataGrids. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-15494)
It was discovered that Dojo was vulnerable to prototype pollution. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-23450)
Jonathan Leitschuh discovered that Dojo did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-10785, CVE-2020-4051)
- Record
USN-7569-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dojoxnpm |
before 1.14.0 | 1.14.0 |
dojoDebian:12 |
before 1.14.1+dfsg1-1 | 1.14.1+dfsg1-1 |
dojoDebian:13 |
before 1.14.1+dfsg1-1 | 1.14.1+dfsg1-1 |
dojoDebian:14 |
before 1.14.1+dfsg1-1 | 1.14.1+dfsg1-1 |
dojoDebian:8 |
before 1.10.2+dfsg-1+deb8u1, plus listed versions 1.10.2+dfsg-1 |
1.10.2+dfsg-1+deb8u1 |
dojoUbuntu:Pro:16.04:LTS |
before 1.10.4+dfsg-2ubuntu0.1~esm1, plus listed versions 1.10.4+dfsg-2 |
1.10.4+dfsg-2ubuntu0.1~esm1 |
dojoUbuntu:18.04:LTS |
All versions, plus listed versions 1.11.0+dfsg-1 |
None known |
dojoUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 1.10.4+dfsg-2ubuntu0.1~esm1, plus listed versions 1.10.4+dfsg-2 |
1.10.4+dfsg-2ubuntu0.1~esm1 |
dojoUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 1.15.0+dfsg1-1ubuntu0.1~esm1, plus listed versions 1.14.2+dfsg1-11.15.0+dfsg1-1 |
1.15.0+dfsg1-1ubuntu0.1~esm1 |
dojoUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 1.15.4+dfsg1-1ubuntu0.1, plus listed versions 1.15.4+dfsg1-1 |
1.15.4+dfsg1-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-15494 is a critical vulnerability (CVSS 9.8) in Dojotoolkit Dojo, published August 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in dojox 1.14.0.