Description
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
Remediation
References
https://hackerone.com/reports/390929
Related Vulnerabilities
CVE-2023-36665 Vulnerability in maven package org.webjars.npm:protobufjs
CVE-2020-36282 Vulnerability in maven package com.rabbitmq.jms:rabbitmq-jms
CVE-2020-8910 Vulnerability in maven package org.webjars.npm:google-closure-library
CVE-2020-17527 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2022-31159 Vulnerability in maven package com.amazonaws:aws-java-sdk-s3