Command Injection in dot
Moderate severity
GitHub Reviewed
Published
Jun 5, 2019
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Reviewed
Jun 5, 2019
Published to the GitHub Advisory Database
Jun 5, 2019
Last updated
Jan 9, 2023
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
References