|Related CVEs||CVE-2018-6561 CVE-2020-4051 CVE-2021-23450|
Multiple vulnerabilities were found in src:dojo, as follows:
`dijit.Editor` in Dojo allows XSS via the onload attribute of an SVG element.
In Dijit, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin.
It was found that Dojo is vulnerable to Prototype Pollution via the setObject function.
For Debian 8 jessie, these problems have been fixed in version 1.10.2+dfsg-1+deb8u4.
We recommend that you upgrade your dojo packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.