critical
CVE-2026-27837
dottie.js: dottie.js: Unauthorized object modification via prototype pollution bypass
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (medium), Red Hat (medium).
Description
Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | node-dottie | no fix listed |
| debian 12 | node-dottie | no fix listed |
| debian 13 | node-dottie | no fix listed |
| debian 14 | node-dottie | 2.0.7+~2.0.7-1 |
| echo | node-dottie | no fix listed |
| npm::GitHub Security Advisory npm | dottie | 2.0.7 |
| rapidfort debian 12 | node-dottie | 0:2.0.7+~2.0.7-1 |
| rapidfort debian 13 | node-dottie | 0:2.0.7+~2.0.7-1 |
| Red Hat | satellite/iop-remediations-rhel9 | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2026-27837
- https://github.com/advisories/GHSA-4gxf-g5gf-22h4
- https://github.com/mickhansen/dottie.js
- https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
- https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27837
- https://www.cve.org/CVERecord?id=CVE-2026-27837