19 matches found
CVE-2026-107700
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107701
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
CVE-2026-107701
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
CVE-2026-107701
The dot-access library (version 1.0.0 ) is vulnerable to a Prototype Pollution vulnerability (CWE-1321) via the set() path argument. By supplying a crafted dotted path containing proto segments—specifically when attackers control the path through user-supplied field names—an attacker can modify O...
CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
EUVD-2026-95147
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
EUVD-2026-95146
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700
The dot-access library (versions 0.0.3 through 1.0.0 ) contains a code injection vulnerability (CWE-94) within the get() function. The root cause is the insecure concatenation of a path argument into a new Function body in index.js. This allows remote attackers to supply crafted paths to reach co...
PT-2026-108154
Name of the Vulnerable Software and Affected Versions dot-access versions prior to 1.0.1 Description A prototype pollution issue exists where attackers can modify Object.prototype by providing a specially crafted dotted path to the set function. By controlling the path, such as through...
PT-2026-108153
Name of the Vulnerable Software and Affected Versions dot-access versions 0.0.3 through 1.0.0 Description A code injection flaw exists where the get function concatenates user-supplied paths into a new Function body within index.js. This allows remote attackers to access constructor.constructor t...
CVE-2026-107701: Improperly Controlled Modification of Object Prototype Attributes
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...
CVE-2026-107700: Improper Control of Generation of Code
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...