CVE-2026-107701 Details
Description
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
A prototype pollution vulnerability has been identified in the 'dot-access' npm package, specifically in versions through 1.0.0. This vulnerability allows attackers to modify 'Object.prototype' by supplying a crafted dotted path to the 'set()' function. By controlling the path, such as through user-supplied field names, attackers can inject properties into all objects, potentially altering authorization flags, default options, or causing the process to crash. Additionally, in some applications, this could be chained to achieve remote code execution.
Users are advised to avoid using 'dot-access' until a patched version is released. Consider migrating to alternatives that are actively maintained and provide proper protections against prototype pollution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2 | [email protected] | ExploitRemedy |
| https://github.com/ntharim/dot-access | [email protected] | ProductVendor |
| https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18 | [email protected] | Source CodeVendor |
| https://github.com/ntharim/dot-access/issues/5 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ntharim dot-access | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |