The dot-prop package before version 5.2.0 is vulnerable to prototype pollution. This vulnerability occurs when using the set() function with attacker-controlled inputs, allowing an attacker to manipulate JavaScript object prototypes, which can lead to denial of service, security bypass, or even remote code execution.
Dot-prop is a popular npm package that allows getting, setting, or deleting nested properties of objects using a dot path notation.
Test the dot-prop vulnerability by setting properties on an object using a path that could lead to prototype pollution:
// Prototype pollution payload:
Property Path: __proto__.polluted
Property Value: Yes, I am polluted!
// Or nested approach:
Property Path: constructor.prototype.polluted
Property Value: Polluted via constructor
// After pollution, check:
console.log({}.polluted); // Will show the polluted value
To mitigate this vulnerability:
// Update command: npm update dot-prop --save // Or pin to a specific safe version: npm install dot-prop@5.2.0 --save