@restura/core (>=0.1.0-alpha.12 <=2.0.3), @restura/logger (=1.0.1) +42 more potentially affected by CVE-2026-27837 via dottie (>=2.0.4 <=2.0.6)

dottie NPM version =2.0.4, =0.1.0-alpha.12, =1.3.53, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.21, =1.0.25, =1.0.25, =1.0.25, =1.3.44, =1.3.53, =1.3.35, =1.6.13-alpha.2 and more Source cves: CVE-2026-27837 Source advisory: OSV:GHSA-R5MX-6WC6-7H9W...

@restura/core (>=0.1.0-alpha.12 <=2.0.3), @restura/logger (=1.0.1) +42 more potentially affected by CVE-2023-26132 +1 more via dottie (>=2.0.4 <=2.0.6)

dottie NPM version =2.0.4, =0.1.0-alpha.12, =1.3.53, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.21, =1.0.25, =1.0.25, =1.0.25, =1.3.44, =1.3.53, =1.3.35, =1.6.13-alpha.2 and more Source cves: CVE-2023-26132, CVE-2026-27837 Source advisory: SNYK:JS-DOTTIE-15360180...

dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()

Summary dottie versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing proto at any position other than...

CVE-2026-27837

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacker to bypass the...

USN-8041-1: Dottie vulnerability

Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the proto magical attribute. An attacker could possibly use this issue to achieve remote code execution...

12g (=0.0.27), 402 (>=0.0.2 <=0.1.1) +1028 more potentially affected by CVE-2023-26132 +1 more via dottie (>=0.0.6-1 <=2.0.3)

dottie NPM version =0.0.6-1, =0.0.2, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =0.0.1, =1.1.7, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2023-26132, CVE-2026-27837 Source advisory: OSV:GHSA-4GXF-G5GF-22H4...

dottie 安全漏洞

dottie is an application from Mick Hansen's personal developer that makes it easy to find nested keys. A security vulnerability exists in versions prior to dottie 2.0.4, which stems from inadequate checking and vulnerability to prototype contamination...