CVE-2026-107701

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.

CVSS 4.0

8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-25)

CWE

CWE-1321

Published

2026-10-08

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

References

• https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2
• https://github.com/ntharim/dot-access
• https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18
• https://github.com/ntharim/dot-access/issues/5
• https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument

Check your stackJSON