Low

Prototype Pollution in Dojox

Disclosed: 10.03.2020
Updated: 11.10.2026 10:22

The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution.

Affected Area:

//https://github.com/dojo/dojox/blob/master/jq.js#L442
		var tobj = {};
		for(var x in props){
			// the "tobj" condition avoid copying properties in "props"
			// inherited from Object.prototype.  For example, if obj has a custom
			// toString() method, don't overwrite it with the toString() method
			// that props inherited from Object.prototype
			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
					if(dojo.isArray(props[x])){
						obj[x] = props[x];
					}else{
						obj[x] = jqMix(obj[x], props[x]);
					}
				}else{
					obj[x] = props[x];
				}

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	dojox	< 1.11.10, >= 1.12.0, < 1.12.8, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.6, >= 1.15.0, < 1.15.3, >= 1.16.0, < 1.16.2	1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2

References

CVSS score 7.7/10

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-94
Platform: npm
Package: dojox
Disclosed: 10.03.2020
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3hw5-q855-g6cw - CC BY 4.0

Vulnerability history: dojox

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 3
First → latest: 10.2018 03.2020
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 1
Low 1

Disclosures per year

2018: 1
2019: 0
2020: 2
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

10.03.2020

Prototype Pollution in Dojox this entry

Low · 7.7 CVE-2020-5259 < 1.11.10, >= 1.12.0, < 1.12.8, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.6, >= 1.15.0, < 1.15.3, >= 1.16.0, < 1.16.2 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2
13.02.2020

XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Medium · 6.1 CVE-2019-10785 < 1.11.9, >= 1.12.0, < 1.12.7, >= 1.13.0, < 1.13.6, >= 1.14.0, < 1.14.5, >= 1.15.0, < 1.15.2, >= 1.16.0, < 1.16.1 1.11.9, 1.12.7, 1.13.6, 1.14.5, 1.15.2, 1.16.1
15.10.2018

dojox vulnerable to unescaped string injection

Critical · 9.8 CVE-2018-15494 < 1.14.0 1.14.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application