Executive brief
dot-notes is a JavaScript library that converts between objects and dot/bracket notation. A prototype pollution vulnerability in its create function allows an attacker to inject malicious properties into JavaScript object prototypes, potentially leading to denial of service, property tampering, or remote code execution depending on how the affected application uses the library.
Technical details
This is a prototype pollution vulnerability in the dot-notes library's create function, classified as CWE-1321 (Improper Neutralization of Special Elements used in a Prototype Pollution Attack). The vulnerability arises from unsafe property definition by path: when an attacker controls the path parameter, they can set it to __proto__.polluted to inject properties into Object.prototype. The attack is network-reachable if the application accepts untrusted input and passes it to the create function. An attacker can trigger denial of service by corrupting Object methods, inject false security properties (e.g., setting isAdmin to true), or achieve remote code execution in applications that evaluate polluted properties. All versions up to and including 3.2.0 are vulnerable; patch version 3.2.1 or higher is available.
Affected products
- dot-notes dot-notes up to and including 3.2.0
Timeline
- 2020-08-14: disclosed
- 2021-05-06: advisory