CVE-2026-27837

Katalog CVE

CVSS 9.8 · Critical EPSS 0,54%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada dottie project dottie. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w exploit · advisory vendor
• https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14 patch
• https://github.com/advisories/GHSA-4gxf-g5gf-22h4 not applicable