kritik
CVE-2026-27837
dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (orta), Red Hat (orta).
Açıklama
Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | node-dottie | düzeltme belirtilmemiş |
| debian 12 | node-dottie | düzeltme belirtilmemiş |
| debian 13 | node-dottie | düzeltme belirtilmemiş |
| debian 14 | node-dottie | 2.0.7+~2.0.7-1 |
| echo | node-dottie | düzeltme belirtilmemiş |
| npm::GitHub Security Advisory npm | dottie | 2.0.7 |
| rapidfort debian 12 | node-dottie | 0:2.0.7+~2.0.7-1 |
| rapidfort debian 13 | node-dottie | 0:2.0.7+~2.0.7-1 |
| Red Hat | satellite/iop-remediations-rhel9 | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2026-27837
- https://github.com/advisories/GHSA-4gxf-g5gf-22h4
- https://github.com/mickhansen/dottie.js
- https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
- https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27837
- https://www.cve.org/CVERecord?id=CVE-2026-27837