CVE-2026-107700 Details

A code injection vulnerability has been identified in the dot-access npm package, specifically in versions 0.0.3 through 1.0.0. This vulnerability allows remote attackers to execute JavaScript by providing crafted paths to the get() function. The issue arises because the path is concatenated into a new Function body, which is then executed. Attackers can exploit this to access constructor properties and load the child_process module, enabling the execution of operating system commands within the Node.js process.

Users are advised to avoid constructing Functions from user input. For the get() function, iterate over the path segments and access properties directly, rather than concatenating the path into a Function. For the set() function, reject path segments that include 'proto', 'constructor', or 'prototype' before descending into the object.