CVE-2026-27837 - Vulnerability Analysis

Overview

Dottie 2.0.4 through 2.0.6 contains a prototype pollution caused by incomplete validation of nested path segments in dottie.set() and dottie.transform(), letting attackers bypass protection and manipulate object prototypes, exploit requires crafted input with nested __proto__ segments.

Severity & Score

Impact

Attackers can manipulate object prototypes, potentially leading to denial of service or privilege escalation.

Mitigation

Upgrade to version 2.0.7 or later.

References

• https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14
• https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w
• https://github.com/advisories/GHSA-4gxf-g5gf-22h4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner