Critical

dojox vulnerable to unescaped string injection

Disclosed: 15.10.2018
Updated: 11.10.2026 10:22

In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	dojox	< 1.14.0	1.14.0

References

CVSS score 9.8/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-116
Platform: npm
Package: dojox
Disclosed: 15.10.2018
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-84cm-x2q5-8225 - CC BY 4.0

Vulnerability history: dojox

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 3
First → latest: 10.2018 03.2020
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 1
Low 1

Disclosures per year

2018: 1
2019: 0
2020: 2
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

10.03.2020

Prototype Pollution in Dojox

Low · 7.7 CVE-2020-5259 < 1.11.10, >= 1.12.0, < 1.12.8, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.6, >= 1.15.0, < 1.15.3, >= 1.16.0, < 1.16.2 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2
13.02.2020

XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Medium · 6.1 CVE-2019-10785 < 1.11.9, >= 1.12.0, < 1.12.7, >= 1.13.0, < 1.13.6, >= 1.14.0, < 1.14.5, >= 1.15.0, < 1.15.2, >= 1.16.0, < 1.16.1 1.11.9, 1.12.7, 1.13.6, 1.14.5, 1.15.2, 1.16.1
15.10.2018

dojox vulnerable to unescaped string injection this entry

Critical · 9.8 CVE-2018-15494 < 1.14.0 1.14.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application