Executive brief
dotty is a JavaScript utility library for manipulating nested object properties. A prototype pollution vulnerability in versions prior to 0.1.1 allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to application crashes (denial of service) or remote code execution depending on how the application processes the polluted objects.
Technical details
This is a prototype pollution vulnerability (CWE-400) in the dotty JavaScript library. The vulnerability occurs when the library processes user-controlled input to set nested object properties without properly validating or sanitizing keys like "__proto__", "constructor", or "prototype". An attacker can craft malicious input that pollutes the Object prototype, affecting all objects in the application. No authentication or special network setup is required—exploitation can occur from network calls if the application uses dotty to process untrusted JSON or query parameters. The fix was released in version 0.1.1.
Affected products
- dotty dotty before 0.1.1
Timeline
- 2021-02-05: disclosed
- 2021-01-25: patched: Fix commit cd997d3 merged; version 0.1.1 released