CVE-2020-8116: 
JavaScript vulnerability analysis and mitigation

CVE-2020-8116 affects the dot-prop npm package, a JavaScript utility library. The vulnerability was discovered in versions before 4.2.1 and versions 5.x before 5.1.1, allowing attackers to add arbitrary properties to JavaScript language constructs such as objects through prototype pollution (NVD).

The vulnerability is classified as a prototype pollution issue (CWE-1321) with a CVSS v3.1 base score of 7.3 (HIGH). The attack vector is network-based, requires low complexity, needs no privileges or user interaction, and has a scope classified as unchanged. The impact affects confidentiality, integrity, and availability, all rated as low (NVD, GitHub Advisory).

The vulnerability allows attackers to add arbitrary properties to JavaScript language constructs such as objects, potentially leading to application security compromises through prototype pollution. This could result in unauthorized modification of object properties and potential application behavior manipulation (NVD).

Users should upgrade to patched versions: version 4.2.1 for the 4.x series or version 5.1.1 for the 5.x series. The fix has been backported to address the widespread use of version 4.x (GitHub Issue).