dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
| CVE | CVE-2026-107701 |
|---|---|
| Severidad | HIGH |
| CVSS | 8.2 / 10 |
| CWE | CWE-1321 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
dot-access 1.0.0
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).