Skip to content
Noroxi

Dojo vulnerabilitiesDojo: known vulnerabilities and safe versions

npm: dojo

Dojo has 7 known vulnerability records: 5 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 2 only in Retire.js (CDN builds and advisories without a CVE).

By branch: 1.x is safe from 1.16.5.

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

BranchSupportLatest on branchRecordsSafe version
1.x——7critical1.16.5

Support dates appear only for libraries that endoflife.date tracks.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

  • CVE-2021-234502021-12-17

    All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

    Affected versions: <= 1.16.4 · < 1.16.5

    critical 9.8

    Fixed in: 1.16.5

    EPSS 30.3%

  • CVE-2020-52582020-03-10

    Prototype pollution in dojo

    Affected versions: < 1.11.10 · >= 1.12.0, < 1.12.8 · >= 1.13.0, < 1.13.7 · >= 1.14.0, < 1.14.6 · >= 1.15.0, < 1.15.3 · >= 1.16.0, < 1.16.2

    high 7.7

    Fixed in: 1.11.10, 1.12.8, 1.13.7, 1.14.6

    EPSS 4%

  • CVE-2018-154942018-08-17

    In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.

    Affected versions: < 1.14

    critical 9.8

    Fixed in: 1.14

    EPSS 2.5%

  • CVE-2015-56542015-10-10

    Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspe

    Affected versions: < 1.9.1 · < 1.2.0

    medium 4.3

    Fixed in: 1.2.0, 1.9.1

    EPSS 2.2%

  • CVE-2010-2275exploit code exists2010-06-15

    Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject ar

    Affected versions: < 1.4.2

    medium 4.3

    Fixed in: 1.4.2

    EPSS 2.8%

  • CVE-2010-2273exploit code exists2010-06-15

    Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3,

    Affected versions: >= 1.13.0, < 1.13.1 · >= 1.12.0, < 1.12.4 · >= 1.11.0, < 1.11.6 · >= 1.10.0, < 1.10.10

    medium 4.3

    Fixed in: 1.10.10, 1.11.6, 1.12.4, 1.13.1

    EPSS 4.5%

  • CVE-2008-66812009-04-09

    Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML v

    Affected versions: < 1.1.0

    medium 4.3

    Fixed in: 1.1.0

    EPSS 1%

Sources and method

Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.

This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.

Data as of October 21, 2026.

Other libraries