# CVE-2020-5258: Dojo prototype pollution in deepCopy

Source: https://junglewise.ai/threats/cve-2020-5258-dojo-prototype-pollution-in-deepcopy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-03-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-5258 · Severity: low · CVSS 3.1 · Published 2020-03-10

Dojo is a popular JavaScript framework used to build web applications. The framework contains a vulnerability in its deepCopy utility function that allows attackers to inject arbitrary properties into JavaScript object prototypes, potentially corrupting application state or enabling code execution on affected pages.

Technologies: [dojo (npm)](https://junglewise.ai/threats/technologies/dojo). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-5258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-5258 being exploited in the wild.

**How severe is CVE-2020-5258?** Low severity, with a CVSS score of 3.1, published 10 March 2020.

**Which products and versions are affected?** dojo (npm) SEMVER:introduced=0,fixed=1.11.10.

**Is there a fix for CVE-2020-5258?** Yes. dojo (npm): upgrade to 1.11.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-5258 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-5258?** Check whether you run dojo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dojo (npm): upgrade to 1.11.10 or later

  ```sh
  npm install dojo@1.11.10
  ```


## Technical details

The vulnerability is a prototype pollution flaw in the dojo/request/util/deepCopy and dojo/mixin modules. The deepCopy method fails to properly sanitize property names during deep object copying, allowing attackers to inject properties into Object.prototype via special keys like __proto__. An attacker can craft a malicious JSON payload that, when passed to deepCopy, pollutes the base object prototype. This requires the attacker to control input passed to the deepCopy function. The vulnerability has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2.

## Affected products

- Dojo dojo <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1

## Identifiers

- CVE-2020-5258
- GHSA-jxfh-8wgv-vfr2

## Timeline

- 2020-03-10: disclosed: Advisory published
- 2020-03-10: patched: Patches released in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2

## References

- [https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2](https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2)

## Related threats

- [Dojo prototype pollution in setObject](https://junglewise.ai/threats/cve-2021-23450-dojo-prototype-pollution-in-setobject)
- [dojo Cross-Site Scripting via unvalidated HTML input](https://junglewise.ai/threats/cve-2015-5654-dojo-cross-site-scripting-via-unvalidated-html-input)
- [Dojo cross-site scripting in dijit.Editor and textarea](https://junglewise.ai/threats/cve-2008-6681-dojo-cross-site-scripting-in-dijit-editor-and-textarea)
- [Dojo DOM-based cross-site scripting in test files](https://junglewise.ai/threats/cve-2010-2273-dojo-dom-based-cross-site-scripting-in-test-files)