What is CVE-2020-5259?

CVE-2020-5259 is a high-severity vulnerability in Dojo Dojox, classified under Code Injection. CVSS score: 7.7/10. Published 2020-03-10.

How severe is CVE-2020-5259?

High severity. CVSS v3 base score is 7.7 out of 10.

RCE in Dojo Dojox

CVE-2020-5259

In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Vulnerability class: RCE (Remote Code Execution)

Published 2020-03-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.020 (80.1th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 80.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: +0.000

Affected products

Dojo Dojox — versions < 1.11.10, >= 1.12.0, < 1.12.8, >= 1.13.0, < 1.13.7
Linuxfoundation Dojox

Weakness classification (CWE)

References

github.com/dojo/dojox/security/advisories/GHSA-3hw5-q855-g6cw (Exploit, Third Party Advisory)
github.com/dojo/dojox/commit/47d1b302b5b23d94e875b77b9b9a8c4f5622c9da (Patch)
lists.debian.org/debian-lts-announce/2020/03/msg00012.html (mailing-list)

Frequently asked questions

What is CVE-2020-5259?: CVE-2020-5259 is a high-severity vulnerability in Dojo Dojox, classified under Code Injection. CVSS score: 7.7/10. Published 2020-03-10.
How severe is CVE-2020-5259?: High severity. CVSS v3 base score is 7.7 out of 10.