CVE-2026-107701

HIGH

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.

CVSS v3.1 Score

8.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
LOW
Published: 10/8/2026Modified: 10/14/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (5)

https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2https://github.com/ntharim/dot-accesshttps://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18https://github.com/ntharim/dot-access/issues/5https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument