CVE-2026-107701
dot-access through 1.0.0 Prototype Pollution via set() path argument
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
| CWE | CWE-1321 |
| Vendor | ntharim |
| Product | dot-access |
| Published | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for ntharim dot-access
Be the first to know when new high vulnerabilities affecting ntharim dot-access are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
ntharim / dot-access
0 ≤ 1.0.0
References
gist.github.com: https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2 github.com: https://github.com/ntharim/dot-access/issues/5 github.com: https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18 github.com: https://github.com/ntharim/dot-access vulncheck.com: https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument
Credits
William Pierson (Retro16)