Skip to content
OpenAdvisories

Package · Debian

node-dottie

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.3
    CVE-2026-27837

    Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()

    Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated pa…

    mickhansen dottie.js node-dottie dottie Debian Ubuntu npm
  • High 7.5
    CVE-2023-26132

    dottie vulnerable to Prototype Pollution

    Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

    dottie node-dottie node-dottie Debian Ubuntu npm