CVE-2026-107701 — dot-access through 1.0.0 Prototype Pollution via set() path argument
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers con…
Published: 2026-10-08 · CVSS: 8.8 · CVSS 4.0
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7