dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()

Description

dottie versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing __proto__ at any position other than the first.

Both dottie.set() and dottie.transform() are affected.

Recommendation

Update the dottie package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.4, <= 2.0.6
• Patched version(s): 2.0.7

References

• GHSA-r5mx-6wc6-7h9w
• CVE-2026-27837
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-amd - CVE-2026-2950

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

dottie