NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

CVE-2020-4051 — dijit

MEDIUMFix: dojo/dijit@462bdcd

CVE-2020-4051 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in dijit. A fix is available for dijit — see the affected versions and patch details below.

Cross-site Scripting in dijit editor's LinkDialog plugin

Also known asGHSA-cxjc-r2fp-7mq6
Published
Updated
Affected
6 pkgs
Patched
6 / 6
Exploits
None indexed
Exploitation data as of Oct 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs68th percentile — riskier than 68% of all scored CVEsHighest risk
0.00%0.56%1.12%1.68%0.2%1.2%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

6 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

10other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
dijitnpm
22Kdownloads / week

Description

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

Affected Packages

6 total 6 fixed
EcosystemPackageVulnerable rangeFix
📦npmdijitall versions1.11.11npm install dijit@1.11.11
📦npmdijit≥ 1.12.0&&< 1.12.91.12.9npm install dijit@1.12.9
📦npmdijit≥ 1.13.0&&< 1.13.81.13.8npm install dijit@1.13.8
📦npmdijit≥ 1.14.0&&< 1.14.71.14.7npm install dijit@1.14.7
📦npmdijit≥ 1.15.0&&< 1.15.41.15.4npm install dijit@1.15.4
📦npmdijit≥ 1.16.0&&< 1.16.31.16.3npm install dijit@1.16.3

Affected Products

6 products · 12 configurations
OS
debian linuxdebian
1 version
10.0
Application
active iq unified managernetapp
all
Application
oncommand insightnetapp
all
Application
oncommand workflow automationnetapp
all
Application
snapcenternetapp
all
Application
dijitopenjsf
≥ 1.16.0 && < 1.16.3
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dijit, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update dijit to 1.11.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-4051 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.
O3 Security · Impact-Aware SCA

Is CVE-2020-4051 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2020-4051: dijit XSS — Fixed in 1.11.11