title: Facing vulnerability security issue for dot-prop when updating to latest npm package
body: <p>I am trying to update npm version to latest <code>6.14.7</code> in <em>package.json</em>.</p>
  <p>After updating npm to the latest, I ran <code>npm audit</code> and got two vulnerabilities for the <code>dot-prop</code> package dependency which is showing under npm path.</p>
  <p>So, I tried updating the latest <code>dot-prop</code> <code>^5.1.1</code>. But still getting the same error.</p>
  <p>Please help me with this how can I manually review and fix.</p>
  <p><strong>Audit Report:</strong></p>
  <blockquote>
  <pre class="lang-none prettyprint-override"><code>[root@redhatdev client]# npm audit
  
                        === npm audit security report ===
  
                                  Manual Review
              Some vulnerabilities require your attention to resolve
  
           Visit https://go.npm.me/audit-guide for additional guidance
  
  
  High              Prototype Pollution
  
  Package           dot-prop
  
  Patched in        &gt;=5.1.1
  
  Dependency of     npm [dev]
  
  Path              npm   libnpx   update-notofoer   configstore   dot-prop
  
  More info         https://npmjs.com/advisories/1213
  
  
  High              Prototype Pollution
  
  Package           dot-prop
  
  Patched in        &gt;=5.1.1
  
  Dependency of     npm [dev]
  
  Path              npm    update-notofoer   configstore   dot-prop
  
  More info         https://npmjs.com/advisories/1213
  
  
  found 2 high severity vulnerabilities in 1674 scanned packages
   2 vulnerabilities require manual review. See the full report for details.
  [root@redhatdev client]#
  </code></pre>
  </blockquote>
  <p><strong>Full Audit report: <code>npm audit --json</code></strong></p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;actions&quot;: [
      {
        &quot;action&quot;: &quot;review&quot;,
        &quot;module&quot;: &quot;dot-prop&quot;,
        &quot;resolves&quot;: [
          {
            &quot;id&quot;: 1213,
            &quot;path&quot;: &quot;npm&gt;libnpx&gt;update-notifier&gt;configstore&gt;dot-prop&quot;,
            &quot;dev&quot;: true,
            &quot;optional&quot;: false,
            &quot;bundled&quot;: true
          },
          {
            &quot;id&quot;: 1213,
            &quot;path&quot;: &quot;npm&gt;update-notifier&gt;configstore&gt;dot-prop&quot;,
            &quot;dev&quot;: true,
            &quot;optional&quot;: false,
            &quot;bundled&quot;: true
          }
        ]
      }
    ],
    &quot;advisories&quot;: {
      &quot;1213&quot;: {
        &quot;findings&quot;: [
          {
            &quot;version&quot;: &quot;4.2.0&quot;,
            &quot;paths&quot;: [
              &quot;npm&gt;libnpx&gt;update-notifier&gt;configstore&gt;dot-prop&quot;,
              &quot;npm&gt;update-notifier&gt;configstore&gt;dot-prop&quot;
            ]
          }
        ],
        &quot;id&quot;: 1213,
        &quot;created&quot;: &quot;2019-10-14T17:43:55.291Z&quot;,
        &quot;updated&quot;: &quot;2020-07-29T20:58:02.206Z&quot;,
        &quot;deleted&quot;: null,
        &quot;title&quot;: &quot;Prototype Pollution&quot;,
        &quot;found_by&quot;: {
          &quot;link&quot;: &quot;&quot;,
          &quot;name&quot;: &quot;Unknown&quot;,
          &quot;email&quot;: &quot;&quot;
        },
        &quot;reported_by&quot;: {
          &quot;link&quot;: &quot;&quot;,
          &quot;name&quot;: &quot;Unknown&quot;,
          &quot;email&quot;: &quot;&quot;
        },
        &quot;module_name&quot;: &quot;dot-prop&quot;,
        &quot;cves&quot;: [
          &quot;CVE-2020-8116&quot;
        ],
        &quot;vulnerable_versions&quot;: &quot;&lt;5.1.1&quot;,
        &quot;patched_versions&quot;: &quot;&gt;=5.1.1&quot;,
        &quot;overview&quot;: &quot;Versions of `dot-prop` before 5.1.1 are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n&quot;,
        &quot;recommendation&quot;: &quot;Upgrade to version 5.1.1 or later.&quot;,
        &quot;references&quot;: &quot;- [GitHub advisory](https://github.com/advisories/GHSA-ff7x-qrg7-qggm)\n- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2020-8116)&quot;,
        &quot;access&quot;: &quot;public&quot;,
        &quot;severity&quot;: &quot;high&quot;,
        &quot;cwe&quot;: &quot;CWE-471&quot;,
        &quot;metadata&quot;: {
          &quot;module_type&quot;: &quot;&quot;,
          &quot;exploitability&quot;: 4,
          &quot;affected_components&quot;: &quot;&quot;
        },
        &quot;url&quot;: &quot;https://npmjs.com/advisories/1213&quot;
      }
    },
    &quot;muted&quot;: [],
    &quot;metadata&quot;: {
      &quot;vulnerabilities&quot;: {
        &quot;info&quot;: 0,
        &quot;low&quot;: 0,
        &quot;moderate&quot;: 0,
        &quot;high&quot;: 2,
        &quot;critical&quot;: 0
      },
      &quot;dependencies&quot;: 61,
      &quot;devDependencies&quot;: 1612,
      &quot;optionalDependencies&quot;: 31,
      &quot;totalDependencies&quot;: 1674
    },
    &quot;runId&quot;: &quot;9b99170c-35c0-44b1-a0e6-8b714069a255&quot;
  }
  
  </code></pre>