CVE-2020-8141: Dot Project Dot

High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days.

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Affected products

• Dot Project Dot: version 1.1.2 only

Published 2020-03-15. Last modified 2026-06-17.