Executive brief
The dot templating library for Node.js is vulnerable to command injection during template compilation. If an attacker can inject malicious code into a template or exploit prototype pollution to modify an object's prototype, they can execute arbitrary system commands with the privileges of the application running dot. This could allow attackers to compromise servers or execute malicious operations.
Technical details
The vulnerability exists in the template compilation process of the dot library (CWE-77: Improper Neutralization of Special Elements used in a Command). All versions up to and including 1.1.2 are affected. An attacker can inject arbitrary commands that will be executed during template compilation if they can control template input or exploit a prototype pollution vulnerability to alter object prototypes. The attack requires either the ability to provide or influence template code, or the ability to trigger prototype pollution in the consuming application. Successful exploitation results in arbitrary command execution in the context of the Node.js process.
Affected products
- npm dot all versions up to 1.1.2
Timeline
- 2019-06-05: disclosed
- 2019-06-05: advisory