Skip to content
OpenAdvisories
High USN-8041-1 1 CVE

node-dottie vulnerability

Published Feb 12, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype
pollution when altering the __proto__ magical attribute. An attacker could
possibly use this issue to achieve remote code execution.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS node-dottie 2.0.2-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS node-dottie 2.0.2-4ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2023-26132

    dottie vulnerable to Prototype Pollution

    Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

    dottie node-dottie node-dottie Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2023-26132