{"id":"CVE-2020-8141","aliases":["CLSA-2026-1792424782","DEBIAN-CVE-2020-8141","EUVD-2022-1949","GHSA-297x-8xj4-vcxv","GHSA-4859-gpc7-4j66"],"status":"published","title":"Improper Control of Generation of Code in doT","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02197,"percentile":0.82645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-94"],"published":"2019-06-05T21:24:29Z","modified":"2026-10-26T12:02:33Z","fixes":[{"ecosystem":"npm","package":"dot","fixed_in":["1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"dot","fixed_in":["1.1.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-dot","fixed_in":["1.1.3+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-dot","fixed_in":["1.1.3+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-dot","fixed_in":["1.1.3+ds-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.2"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1-tuxcare.0"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-dot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-dot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-dot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+ds-1"}]}]},{"source":"osv","ecosystem":"npm","package":"dot","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"dot","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.2"}]}]}],"products":[{"vendor":"alexpinel","product":"dot"},{"vendor":"dot_project","product":"dot"}],"references":[{"url":"https://hackerone.com/reports/390929","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8141","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-297x-8xj4-vcxv"},{"url":"https://www.npmjs.com/advisories/798","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4859-gpc7-4j66"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8141","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-8141","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2020-03-15T17:04:40Z","modified":"2024-08-04T09:48:25.637Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2022-1949","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2020-03-15T17:04:40Z","modified":"2024-08-04T09:48:25Z","updated_at":"2026-11-03T03:07:58.055641Z"}],"ghsa":[{"id":"GHSA-297x-8xj4-vcxv","title":"Improper Control of Generation of Code in doT","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2022-05-24T17:11:32Z","modified":"2023-01-27T05:02:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:18.427692Z"},{"id":"GHSA-4859-gpc7-4j66","title":"Command Injection in dot","description":"All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.","status":"published","published":"2019-06-05T21:24:29Z","modified":"2023-01-09T05:01:43Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2020-8141","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2020-03-15T18:15:11.287Z","modified":"2026-06-17T03:25:55.9Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:05:55.32877Z"}],"osv":[{"id":"CVE-2020-8141","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2020-03-15T18:15:11.287Z","modified":"2026-11-10T02:30:59.869915684Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T11:06:18.000901Z"},{"id":"DEBIAN-CVE-2020-8141","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2020-03-15T18:15:11.287Z","modified":"2026-10-26T12:02:33.289211893Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-297x-8xj4-vcxv","title":"Improper Control of Generation of Code in doT","description":"The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.","status":"published","published":"2022-05-24T17:11:32Z","modified":"2023-11-08T04:04:14.259926Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"CLSA-2026-1792424782","title":"TuxCare security update for dot (2 CVEs)","description":"TuxCare rebuilt dot to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.","status":"published","published":"2026-10-19T15:46:22Z","modified":"2026-10-19T19:15:02.914592858Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"GHSA-4859-gpc7-4j66","title":"Command Injection in dot","description":"All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.","status":"published","published":"2019-06-05T21:24:29Z","modified":"2021-08-04T20:55:57Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}