crítica
CVE-2026-27837
dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Red Hat (media).
Descripción
Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | node-dottie | sin corrección indicada |
| debian 12 | node-dottie | sin corrección indicada |
| debian 13 | node-dottie | sin corrección indicada |
| debian 14 | node-dottie | 2.0.7+~2.0.7-1 |
| echo | node-dottie | sin corrección indicada |
| npm::GitHub Security Advisory npm | dottie | 2.0.7 |
| rapidfort debian 12 | node-dottie | 0:2.0.7+~2.0.7-1 |
| rapidfort debian 13 | node-dottie | 0:2.0.7+~2.0.7-1 |
| Red Hat | satellite/iop-remediations-rhel9 | sin corrección indicada |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-27837
- https://github.com/advisories/GHSA-4gxf-g5gf-22h4
- https://github.com/mickhansen/dottie.js
- https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
- https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27837
- https://www.cve.org/CVERecord?id=CVE-2026-27837