VulnerableCode Package Details - pkg:npm/dojo@1.9.6

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/dojo@1.9.6

Essentials
History (4)

purl	pkg:npm/dojo@1.9.6

Next non-vulnerable version	1.17.0
Latest non-vulnerable version	2.0.0-alpha.5
Risk	4.5

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-axzg-9rug-83h6 Aliases: CVE-2018-15494 GHSA-84cm-x2q5-8225	dojox vulnerable to unescaped string injection	1.14.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-hn24-qggt-83g3 Aliases: CVE-2018-1000665 GHSA-vmq9-cm7m-4p8p	Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14.	1.13.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 1.14.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-yjbb-bqwz-tfd9 Aliases: CVE-2020-5258 GHSA-jxfh-8wgv-vfr2	Prototype pollution in dojo	1.11.10 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.12.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.13.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.14.0-pre Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 1.14.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.15.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.16.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 2.0.0-alpha.5 Affected by 0 other vulnerabilities.
VCID-zdmu-4wde-3ufc Aliases: CVE-2021-23450 GHSA-m8gw-hjpr-rjv7	Prototype Pollution in dojo	1.17.0 Affected by 0 other vulnerabilities. 2.0.0-alpha.5 Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T17:54:30.072368+00:00	GitLab Importer	Affected by	VCID-zdmu-4wde-3ufc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2021-23450.yml	38.6.0
2026-06-12T17:18:32.941812+00:00	GitLab Importer	Affected by	VCID-yjbb-bqwz-tfd9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2020-5258.yml	38.6.0
2026-06-12T17:03:34.535179+00:00	GitLab Importer	Affected by	VCID-hn24-qggt-83g3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2018-1000665.yml	38.6.0
2026-06-12T17:03:22.100425+00:00	GitLab Importer	Affected by	VCID-axzg-9rug-83h6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/dojo/CVE-2018-15494.yml	38.6.0