CVE-2020-8141
Improper Control of Generation of Code in doT
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
CVE-2020-8141- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
CVE-2020-8141- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2022-1949 No score
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
EUVD-2022-1949- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-297x-8xj4-vcxv
Improper Control of Generation of Code in doT
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
GHSA-297x-8xj4-vcxv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4859-gpc7-4j66 No score
Command Injection in dot
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
- Record
GHSA-4859-gpc7-4j66- Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
CVE-2020-8141- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2020-8141
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
DEBIAN-CVE-2020-8141- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-297x-8xj4-vcxv
Improper Control of Generation of Code in doT
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
- Record
GHSA-297x-8xj4-vcxv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVCLSA-2026-1792424782 No score
TuxCare security update for dot (2 CVEs)
TuxCare rebuilt dot to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.
- Record
CLSA-2026-1792424782- Updated
- 2026-11-02
OSVGHSA-4859-gpc7-4j66 No score
Command Injection in dot
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
- Record
GHSA-4859-gpc7-4j66- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dotnpm |
through 1.1.2 | 1.1.3 |
dotTuxCare:npm |
1.1.1-tuxcare.0 up to 1.1.1-tuxcare.1, plus listed versions 1.1.1 |
1.1.1-tuxcare.1 |
node-dotDebian:12 |
before 1.1.3+ds-1 | 1.1.3+ds-1 |
node-dotDebian:13 |
before 1.1.3+ds-1 | 1.1.3+ds-1 |
node-dotDebian:14 |
before 1.1.3+ds-1 | 1.1.3+ds-1 |
dotnpm |
before 1.1.3 | 1.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8141 is a high vulnerability (CVSS 8.8) in Alexpinel Dot, published June 5, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. Fixed in dot 1.1.3.