{"action":"Upgrade dojo to 1.11.10 or later.","affected":[{"fixed":"1.11.10","introduced":"0"},{"fixed":"1.12.8","introduced":"1.12.0"},{"fixed":"1.13.7","introduced":"1.13.0"},{"fixed":"1.14.6","introduced":"1.14.0"},{"fixed":"1.15.3","introduced":"1.15.0"},{"fixed":"1.16.2","introduced":"1.16.0"}],"component":"dojo","cve_ids":["CVE-2020-5258"],"ecosystem":"npm","epss":0.04023,"exploited":false,"fixed_versions":["1.11.10","1.12.8","1.13.7","1.14.6","1.15.3","1.16.2"],"ghsa_id":"GHSA-jxfh-8wgv-vfr2","id":"tcs_01M5KFZ63PCD7HJYJSP5PCTR4S","modified_at":"2026-09-10T03:48:29.334564051Z","published_at":"2020-03-10T18:03:14Z","references":["https://osv.dev/vulnerability/GHSA-jxfh-8wgv-vfr2","https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2","https://nvd.nist.gov/vuln/detail/CVE-2020-5258","https://github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d","https://github.com/dojo/dojo","https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b@%3Cusers.qpid.apache.org%3E","https://lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6df326fd3@%3Cusers.qpid.apache.org%3E","https://lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a806554d00@%3Cusers.qpid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-jxfh-8wgv-vfr2","url":"https://osv.dev/vulnerability/GHSA-jxfh-8wgv-vfr2"}],"summary":"Prototype pollution in dojo"}