kritisch
CVE-2026-27837
dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (mittel), Red Hat (mittel).
Beschreibung
Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | node-dottie | kein Fix angegeben |
| debian 12 | node-dottie | kein Fix angegeben |
| debian 13 | node-dottie | kein Fix angegeben |
| debian 14 | node-dottie | 2.0.7+~2.0.7-1 |
| echo | node-dottie | kein Fix angegeben |
| npm::GitHub Security Advisory npm | dottie | 2.0.7 |
| rapidfort debian 12 | node-dottie | 0:2.0.7+~2.0.7-1 |
| rapidfort debian 13 | node-dottie | 0:2.0.7+~2.0.7-1 |
| Red Hat | satellite/iop-remediations-rhel9 | kein Fix angegeben |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-27837
- https://github.com/advisories/GHSA-4gxf-g5gf-22h4
- https://github.com/mickhansen/dottie.js
- https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
- https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27837
- https://www.cve.org/CVERecord?id=CVE-2026-27837