Description
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Remediation
References
https://hackerone.com/reports/390929
Related Vulnerabilities
CVE-2022-23708 Vulnerability in maven package org.elasticsearch:elasticsearch
CVE-2022-45208 Vulnerability in maven package org.jeecgframework.boot:jeecg-module-system
CVE-2023-25766 Vulnerability in maven package org.jenkins-ci.plugins:azure-credentials
CVE-2020-7767 Vulnerability in npm package express-validators
CVE-2022-43433 Vulnerability in maven package io.jenkins.plugins:screenrecorder