Prototype Pollution

Vulnerability

The Dojo Toolkit (all versions) is vulnerable to Prototype Pollution via the setObject function in _base/lang.js [1][3]. This function allows setting properties on objects using a path string, and it does not properly sanitize the __proto__ key, enabling an attacker to pollute the base Object prototype [3]. Affected: all versions of the dojo package [1].

Exploitation

An attacker can exploit this by providing a crafted object with a __proto__ property to the setObject function. No authentication is required if the application processes user-supplied data through this function [3]. The attacker can inject arbitrary properties into Object.prototype, which then propagate to all JavaScript objects in the application [3].

Impact

Successful exploitation leads to Prototype Pollution, which can result in denial of service (via JavaScript exceptions) or remote code execution if the polluted properties affect application logic [3]. The attacker may also tamper with application behavior by overriding existing properties [3].

Mitigation

As of the available references, no patch has been released for the Dojo 1.x line [2]. The Dojo 1.x toolkit is in maintenance mode with no active development [2]. Users should consider migrating to Dojo 2+ or other modern frameworks. No workaround is provided in the references. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.