Search for packages
| purl | pkg:npm/dojo@1.12.3 |
| Next non-vulnerable version | 1.17.0 |
| Latest non-vulnerable version | 2.0.0-alpha.5 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-axzg-9rug-83h6
Aliases: CVE-2018-15494 GHSA-84cm-x2q5-8225 |
dojox vulnerable to unescaped string injection |
Affected by 2 other vulnerabilities. |
|
VCID-hn24-qggt-83g3
Aliases: CVE-2018-1000665 GHSA-vmq9-cm7m-4p8p |
Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14. |
Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-mzd4-yrq8-3bhj
Aliases: CVE-2010-2273 GHSA-536q-8gxx-m782 |
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html. |
Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-yjbb-bqwz-tfd9
Aliases: CVE-2020-5258 GHSA-jxfh-8wgv-vfr2 |
Prototype pollution in dojo |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-zdmu-4wde-3ufc
Aliases: CVE-2021-23450 GHSA-m8gw-hjpr-rjv7 |
Prototype Pollution in dojo |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T17:54:30.219041+00:00 | GitLab Importer | Affected by | VCID-zdmu-4wde-3ufc | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2021-23450.yml | 38.6.0 |
| 2026-06-12T17:18:33.085136+00:00 | GitLab Importer | Affected by | VCID-yjbb-bqwz-tfd9 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2020-5258.yml | 38.6.0 |
| 2026-06-12T17:14:06.280778+00:00 | GitLab Importer | Affected by | VCID-mzd4-yrq8-3bhj | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2010-2273.yml | 38.6.0 |
| 2026-06-12T17:03:34.667905+00:00 | GitLab Importer | Affected by | VCID-hn24-qggt-83g3 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2018-1000665.yml | 38.6.0 |
| 2026-06-12T17:03:22.237684+00:00 | GitLab Importer | Affected by | VCID-axzg-9rug-83h6 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2018-15494.yml | 38.6.0 |